Getting Data In

metrics - if field not present in raw data how to add it with default value?

imrago
Contributor
In the data source I am ingesting it can happen that one of the fields is not present from time to time. The issue is when I am running a search on it and if I add that dimension to the query that event is not part of the calculation. 

Is it possible to somehow add a field to metrics with a default value if it is not present in the raw event?
0 Karma

solarboyz1
Builder

Have you tried something like:

 index=YOURINDEX   FIELD_Name>*  OR NOT FIELD_name
| eval FIELD_Name=if(isnotnull(FIELD_Name), FIELD_Name, "Default value to fill in")

https://docs.splunk.com/Documentation/Splunk/7.3.1/Search/NOTexpressions

0 Karma

imrago
Contributor

Agreed, that would work in regular indexes, but I need it for metrics based indexes.

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...