Splunk Enterprise

Help with if "null" command

super_saiyan
Communicator

Hi splunkers,

I want to use "null"  command in below query. If the message is "null" then it should replace with the below message otherwise it should only display the already extracted message. 

 

| eval message= if(Actor="superman","super hero", if(Actor="emma watson","model"))

Thanks.

Labels (2)
0 Karma

somesoni2
Revered Legend

Give this a try

| eval message= coalesce(message,case(Actor="superman","super hero",Actor="emma watson","model", true(),"NA"))

super_saiyan
Communicator

Thanks for your quick response @somesoni2 
could you please also provide the spl using "isnull" ?

Really appreciate your support.

0 Karma

somesoni2
Revered Legend
| eval message= if(isnotnull(message),message,case(Actor="superman","super hero",Actor="emma watson","model", true(),"NA"))
0 Karma

inventsekar
Super Champion

Hi @super_saiyan ... please check this isnull():

|makeresults | eval Actor="emma watson" 
| eval message = if(isnull(message),if(Actor="superman","super hero", if(Actor="emma watson","model", "not emma")),message) | table message

 

if-cmd.png

 

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.

super_saiyan
Communicator

I am getting error while using the below SPL Query

Could you please help me with that ?

super_saiyan_0-1659075047799.png

 

appreciate your help.

 

0 Karma

inventsekar
Super Champion

Hi @super_saiyan .. your "if" format was wrong.. pls check this..

|makeresults | eval Actor="emma watson" | eval message = if(isnull(message, null(),if(Actor="superman","super hero", if(Actor="emma watson","model", "not emma")) | table message

 

could you pls check this and update us with some more details:

>>> If the message is "null" then it should replace with the below message.

>>> otherwise it should only display the already extracted message. 

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...