Getting Data In

metrics - if field not present in raw data how to add it with default value?

imrago
Contributor
In the data source I am ingesting it can happen that one of the fields is not present from time to time. The issue is when I am running a search on it and if I add that dimension to the query that event is not part of the calculation. 

Is it possible to somehow add a field to metrics with a default value if it is not present in the raw event?
0 Karma

solarboyz1
Builder

Have you tried something like:

 index=YOURINDEX   FIELD_Name>*  OR NOT FIELD_name
| eval FIELD_Name=if(isnotnull(FIELD_Name), FIELD_Name, "Default value to fill in")

https://docs.splunk.com/Documentation/Splunk/7.3.1/Search/NOTexpressions

0 Karma

imrago
Contributor

Agreed, that would work in regular indexes, but I need it for metrics based indexes.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!