Splunk Enterprise Security

Coalesce two fields with null values

lxm30
New Member

I have two fields and if field1 is empty, I want to use the value in field2. (i.e. I never want to use field2 unless field1 is empty).

I was trying to use a coalesce function but it doesn't work well with null values.

Do I have any options beyond using fillnull for field2 with a value of *, coalescing the two and then using rtrim to get rid of the star?

0 Karma
1 Solution

martinpu
Communicator

Try this

|eval field3=case(isNotNull(field1),field1,isNotNull(field2),field2,1=1, NULL)

should return field 3 as field1 if it isnt null,field2 if that isnt null and field1 is null and NULL if both are NULL

View solution in original post

0 Karma

martinpu
Communicator

Try this

|eval field3=case(isNotNull(field1),field1,isNotNull(field2),field2,1=1, NULL)

should return field 3 as field1 if it isnt null,field2 if that isnt null and field1 is null and NULL if both are NULL

0 Karma

lxm30
New Member

This works great - thanks so much for the quick response!

0 Karma

lxm30
New Member

(By * I mean some value, not necessarily the character "*").

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...