Splunk Search

Can I fill a null value with another field's value in the event?

donk23
New Member

I have seen two other related questions but neither of the answers have worked for me.

Data:

Events with a controller_node and an execution_node (controller node is blank if run locally on execution_node).

id, controller_node, execution_node
1,a,b
2,,a
3,,a
4,,b
5,,b
6,,b
7,b,a
8,,a

Trying "...|eval controller_node=coalesce(controller_node, execution_node|stats count by controller_node" should return:
a: 4
b:4

However, I am only getting:
a:1
b:1
NULL:6

I don't think the eval is working as expected. I also tried to do "...|fillnull value=execution_node controller_node" to no avail.

What is the correct way to evaluate if controller_node is null on each event and set the null value to the value of execution_node unique to each event?

0 Karma
1 Solution

knielsen
Contributor

Interesting. I would have thought the coalesce should work.

I could reproduce it though, I think controller_node is actually not null, but just empty for you. As workaround, you could use len() on controller_node.

My test:

| makeresults | eval input="1,a,b;2,,a;3,,a;4,,b;5,,b;6,,b;7,b,a;8,,a"  | makemv delim=";" input | mvexpand input | rex field=input "(?<id>[^,]+),(?<controller_node>[^,]*),(?<execution_node>.+)" | eval controller_node=if(len(controller_node)>0,controller_node,execution_node)

View solution in original post

woodcock
Esteemed Legend

This works for me:

| makeresults 
| eval _raw="id,controller_node,execution_node
1,a,b
2,,a
3,,a
4,,b
5,,b
6,,b
7,b,a
8,,a" 
| multikv forceheader=1 
| fields id controller_node execution_node 
| eval controller_node=coalesce(controller_node, execution_node)
| stats count by controller_node

I get this:

controller_node count
a                     4
b                     4
0 Karma

knielsen
Contributor

Interesting. I would have thought the coalesce should work.

I could reproduce it though, I think controller_node is actually not null, but just empty for you. As workaround, you could use len() on controller_node.

My test:

| makeresults | eval input="1,a,b;2,,a;3,,a;4,,b;5,,b;6,,b;7,b,a;8,,a"  | makemv delim=";" input | mvexpand input | rex field=input "(?<id>[^,]+),(?<controller_node>[^,]*),(?<execution_node>.+)" | eval controller_node=if(len(controller_node)>0,controller_node,execution_node)

View solution in original post

woodcock
Esteemed Legend
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!