Splunk Search

Can you help me with the following query using the coalesce command?

pfabrizi
Path Finder

I am trying this transform. Sometime the subjectuser is set and sometimes the targetuser. All works fine, but the data coming into the subject user is a dash, and that is what user is getting set to instead of the value that is correct in target user.

Is there any way around this? So, if a subject user is less than 2 characters for example?

Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

You can use this:

EVAL-subjectuser=if(subjectuser=="-", targetuser, subjectuser)

Or in search SPL, this:

| eval subjectuser=if(subjectuser=="-", targetuser, subjectuser)

View solution in original post

0 Karma

woodcock
Esteemed Legend

You can use this:

EVAL-subjectuser=if(subjectuser=="-", targetuser, subjectuser)

Or in search SPL, this:

| eval subjectuser=if(subjectuser=="-", targetuser, subjectuser)
0 Karma

Vijeta
Influencer

you can add | replace "-" with "" in subjectuser before coalesce

0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...