I'm currently looking at partially complete logs, where some contain an articleid, but some don't. Is it possible to take a value from a different field (videoid) to populate that field when is it null? Currently I'm trying to use this query:
index="video" | fillnull value=video_id article_id
Obviously it's intended to put the value from the videoid into articleid where articleid is null, but it only puts the string "videoid" instead. Is there a way around this?
Use Eval-Coalesce instead
index="video" | eval article_id=coalesce(article_id,video_id) |...
This will take the first non-null value from articleid,videoid and populate to article_id.
View solution in original post