How to create an eval for a field if it does not exist?

[mjuestel2]

I am in the process of normalizing data, so I can apply it to a data model. One of the fields which is having issues is called user.

I have user data in some logs, while other logs have an empty user field - but do have data in a src_user field.

Tried using the coalesce command - but that does not seem to work.

EVAL-user = coalesce(user, src_user)

Is it because I am trying to reference the user field? 

Are there any other work arounds to create a user field when it is empty and filling data from src_user ? Remember, some logs have valid data in the user field. Others have no data.

Thanks!

[woodcock · Accepted solution]

It is likely that it is already done correctly for you if this is typical Enterprise software generating the data and you have the matching TAs installed everywhere.  In other words, "src_user" and "user" are typically different because it is "src_user" (e.g. "admin") doing something TO some other "user".  In any case, the reason that your calculated search is not working is because of this:
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchtimeoperationssequence

[gcusello]

Hi @mjuestel2,

to normalize the src_user field from the user field you can use an alias field (this is the usual approach to missing fields or fields with a wrong name).

If instead there are some events that have the src_user and some others that don't have it, you can use the coalesce option in eval.

If it doesan't run, you can use a calculated field like the following:

| eval src_user=if(isnull(src_user),user,src_user)

Ciao.

Giuseppe