Splunk Search

Can you help me with the following query using the coalesce command?

pfabrizi
Path Finder

I am trying this transform. Sometime the subjectuser is set and sometimes the targetuser. All works fine, but the data coming into the subject user is a dash, and that is what user is getting set to instead of the value that is correct in target user.

Is there any way around this? So, if a subject user is less than 2 characters for example?

Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

You can use this:

EVAL-subjectuser=if(subjectuser=="-", targetuser, subjectuser)

Or in search SPL, this:

| eval subjectuser=if(subjectuser=="-", targetuser, subjectuser)

View solution in original post

0 Karma

woodcock
Esteemed Legend

You can use this:

EVAL-subjectuser=if(subjectuser=="-", targetuser, subjectuser)

Or in search SPL, this:

| eval subjectuser=if(subjectuser=="-", targetuser, subjectuser)
0 Karma

Vijeta
Influencer

you can add | replace "-" with "" in subjectuser before coalesce

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...