Splunk Search
Highlighted

Can I fill null results of a field with results from another field?

Explorer

Hi,

I'm currently looking at partially complete logs, where some contain an articleid, but some don't. Is it possible to take a value from a different field (videoid) to populate that field when is it null? Currently I'm trying to use this query:

index="video" | fillnull value=video_id article_id

Obviously it's intended to put the value from the videoid into articleid where articleid is null, but it only puts the string "videoid" instead. Is there a way around this?

Anthony

Highlighted

Re: Can I fill null results of a field with results from another field?

SplunkTrust
SplunkTrust

Use Eval-Coalesce instead

index="video" | eval article_id=coalesce(article_id,video_id) |...

This will take the first non-null value from articleid,videoid and populate to article_id.

View solution in original post