Splunk Search

Can I fill null results of a field with results from another field?

anthony_copus
Explorer

Hi,

I'm currently looking at partially complete logs, where some contain an article_id, but some don't. Is it possible to take a value from a different field (video_id) to populate that field when is it null? Currently I'm trying to use this query:

index="video" | fillnull value=video_id article_id

Obviously it's intended to put the value from the video_id into article_id where article_id is null, but it only puts the string "video_id" instead. Is there a way around this?

Anthony

1 Solution

somesoni2
Revered Legend

Use Eval-Coalesce instead

index="video" | eval article_id=coalesce(article_id,video_id) |...

This will take the first non-null value from article_id,video_id and populate to article_id.

View solution in original post

somesoni2
Revered Legend

Use Eval-Coalesce instead

index="video" | eval article_id=coalesce(article_id,video_id) |...

This will take the first non-null value from article_id,video_id and populate to article_id.

Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...