Can I perform If-Then-Else logic within a search?

[maverick]

I have a field that I want to report on, but in some of my events, that field is missing (null) and so I'd like to use another field value instead. Is there a way to perform an in-line "If-Then-Else" type logic within the search itself?

[cyue_splunk]

I'll use " | eval coalesce... "

[rshoward]

I know the question is old, and the question was about if then else, but OP was really asking for coalesce and this is the right answer here. | eval field=coalesce(field1,field2,"misc") will return assign field to the first non-null result in a list. e.g. field1 if its not null, if it is null coalesce will return field2, if that is null as well, the field will just be the string "misc".

[maverick]

Also, see this page in the Splunk docs for more details regaring the "eval" command:

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eval

Also, see this page regarding the functions that can be used with the "eval" command:

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions

[steveyz]

... | eval field=if(isnull(field),elsefield,field) | ...

or use directly within a stats

... | stats sum(eval(if(isnull(field),elsefield,field))) as mysum ...