Splunk Enterprise

is it possible to execute code based on a condition?

antonio147
Communicator

Hi all,
I wanted to ask a question: "is it possible to execute code based on a condition"?
example: if A = B then "rename C as D" else "add a column"

My problem:
the where returns columns usually 2, (DIRECT, INDIRECT) but there are some cases that returns 3 (DIRECT, INDIRECT, SPC)
a case that returns only 1 (INDIRECT)
another that returns 1 (DIRECT).
When I do the chart, the third field is called "row 3" (I hope to solve with rename).
When I have only one field (INDIRECT) it is called "row 1" but if I call it "DIRECT" it is not good as the values ​​are from the INDIRECT.
Same thing for the field only (LIVE).
The problem I would like is that the chart always has 2 bars for both DIRECT and INDIRECT, even when there is not one of the two.

with this code I have:
| stats sum (*) by OFFERTA
| transpose
| addtotals fieldname = "TOTAL"
| rename "row 1" as "DIRECT"
| rename "row 2" as "INDIRECT"
| rename "row 3" as "SPC"

Solar year                                            DIRECT     INDIRECT     TOTAL
sum (00_PREVIOUS_MONTH)        8                    4                 12
sum (01_PREVIOUS_MONTH)      32                  16               48
sum (02_PREVIOUS_MONTH)      42                 10               52
sum (03_PREVIOUS_MONTH)      30                  8                38

but if I only have 1 field (INDIRECT)
I have as a result:

Solar Year                                                  DIRECT       TOTAL
sum (00_PREVIOUS_MONTH)              0                   0
sum (01_PREVIOUS_MONTH)              3                  3
sum (02_PREVIOUS_MONTH)              1                  1
sum (03_PREVIOUS_MONTH)               3                 3
sum (04_PREVIOUS_MONTH)               2                  2

 

I would like the chart to have also in this case the two fields with DIRECT and INDIRECT with the DIRECT field all zero

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
Have you try to use fillnull before stats for those null values? As you sum those then it shouldn't be a issue if those missing fields have value 0.
r. Ismo
https://docs.splunk.com/Documentation/Splunk/8.2.3/SearchReference/Fillnull
0 Karma

antonio147
Communicator

Yes I tried with fillnull but despite the zero values, the field names are wrong.
Maybe I solved it by editing the | command stats sum
Thank you

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...