Splunk Search

Coalesce function not working with extracted fields

poddraj
Explorer

Hi,

I am using below simple search where I am using coalesce to test.

index=fios 110788439127166000 
| eval check=coalesce(SVC_ID,DELPHI_REQUEST.REQUEST.COMMAND)
| table 
 DELPHI_REQUEST.REQUEST.COMMAND ,host,SVC_ID,check
 |rename DELPHI_REQUEST.REQUEST.COMMAND as "COMMAND"

I am getting below output where coalesce is not printing the value of field DELPHI_REQUEST.REQUEST.COMMAND instead it is printing null value.

                COMMAND                   host     SVC_ID         check
                ------------------------------------------------------------------------------------------
                GET_TOPOLOGY            dlfdam1                        
                GET_TOPOLOGY            dlfdam1                         

However, if I use below query coalesce is working fine.

index=fios 110788439127166000 
| eval check=coalesce(SVC_ID,host)
| table DELPHI_REQUEST.REQUEST.COMMAND ,host,SVC_ID,check
|rename DELPHI_REQUEST.REQUEST.COMMAND as "COMMAND"

                COMMAND                     host       SVC_ID      check
                ----------------------------------------------------------------------------------------
                GET_TOPOLOGY            dlfdam1                      dlfdam1                        
                GET_TOPOLOGY            dlfdam1                      dlfdam1    

Can someone let me understand why it is not working with extracted fields and working with host field

0 Karma
1 Solution

PavelP
Motivator

try to first rename then coalesce

 index=fios 110788439127166000 
  |rename DELPHI_REQUEST.REQUEST.COMMAND as "COMMAND"
 | eval check=coalesce(SVC_ID,COMMAND)
 | table COMMAND ,host,SVC_ID,check

View solution in original post

0 Karma

PavelP
Motivator

try to first rename then coalesce

 index=fios 110788439127166000 
  |rename DELPHI_REQUEST.REQUEST.COMMAND as "COMMAND"
 | eval check=coalesce(SVC_ID,COMMAND)
 | table COMMAND ,host,SVC_ID,check
0 Karma

poddraj
Explorer

Thanks it worked. What I observed is due to . in my field name it is not working with coalesce function if I use same name replacing . with _ it is working like below

index=fios 110788439127166000
|rename DELPHI_REQUEST.REQUEST.COMMAND as "DELPHI_REQUEST_REQUEST_COMMAND"
| eval check=coalesce(SVC_ID,DELPHI_REQUEST_REQUEST_COMMAND)
| table DELPHI_REQUEST_REQUEST_COMMAND,host,SVC_ID,check

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Or you can try to use ‘FIELD.NAME’ instead of FIELD.NAME.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...