Splunk Search

Can I fill a null value with another field's value in the event?

donk23
New Member

I have seen two other related questions but neither of the answers have worked for me.

Data:

Events with a controller_node and an execution_node (controller node is blank if run locally on execution_node).

id, controller_node, execution_node
1,a,b
2,,a
3,,a
4,,b
5,,b
6,,b
7,b,a
8,,a

Trying "...|eval controller_node=coalesce(controller_node, execution_node|stats count by controller_node" should return:
a: 4
b:4

However, I am only getting:
a:1
b:1
NULL:6

I don't think the eval is working as expected. I also tried to do "...|fillnull value=execution_node controller_node" to no avail.

What is the correct way to evaluate if controller_node is null on each event and set the null value to the value of execution_node unique to each event?

0 Karma
1 Solution

knielsen
Contributor

Interesting. I would have thought the coalesce should work.

I could reproduce it though, I think controller_node is actually not null, but just empty for you. As workaround, you could use len() on controller_node.

My test:

| makeresults | eval input="1,a,b;2,,a;3,,a;4,,b;5,,b;6,,b;7,b,a;8,,a"  | makemv delim=";" input | mvexpand input | rex field=input "(?<id>[^,]+),(?<controller_node>[^,]*),(?<execution_node>.+)" | eval controller_node=if(len(controller_node)>0,controller_node,execution_node)

View solution in original post

woodcock
Esteemed Legend

This works for me:

| makeresults 
| eval _raw="id,controller_node,execution_node
1,a,b
2,,a
3,,a
4,,b
5,,b
6,,b
7,b,a
8,,a" 
| multikv forceheader=1 
| fields id controller_node execution_node 
| eval controller_node=coalesce(controller_node, execution_node)
| stats count by controller_node

I get this:

controller_node count
a                     4
b                     4
0 Karma

knielsen
Contributor

Interesting. I would have thought the coalesce should work.

I could reproduce it though, I think controller_node is actually not null, but just empty for you. As workaround, you could use len() on controller_node.

My test:

| makeresults | eval input="1,a,b;2,,a;3,,a;4,,b;5,,b;6,,b;7,b,a;8,,a"  | makemv delim=";" input | mvexpand input | rex field=input "(?<id>[^,]+),(?<controller_node>[^,]*),(?<execution_node>.+)" | eval controller_node=if(len(controller_node)>0,controller_node,execution_node)

woodcock
Esteemed Legend
Get Updates on the Splunk Community!

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...