Splunk Search

Coalesce function not working with extracted fields

poddraj
Explorer

Hi,

I am using below simple search where I am using coalesce to test.

index=fios 110788439127166000 
| eval check=coalesce(SVC_ID,DELPHI_REQUEST.REQUEST.COMMAND)
| table 
 DELPHI_REQUEST.REQUEST.COMMAND ,host,SVC_ID,check
 |rename DELPHI_REQUEST.REQUEST.COMMAND as "COMMAND"

I am getting below output where coalesce is not printing the value of field DELPHI_REQUEST.REQUEST.COMMAND instead it is printing null value.

                COMMAND                   host     SVC_ID         check
                ------------------------------------------------------------------------------------------
                GET_TOPOLOGY            dlfdam1                        
                GET_TOPOLOGY            dlfdam1                         

However, if I use below query coalesce is working fine.

index=fios 110788439127166000 
| eval check=coalesce(SVC_ID,host)
| table DELPHI_REQUEST.REQUEST.COMMAND ,host,SVC_ID,check
|rename DELPHI_REQUEST.REQUEST.COMMAND as "COMMAND"

                COMMAND                     host       SVC_ID      check
                ----------------------------------------------------------------------------------------
                GET_TOPOLOGY            dlfdam1                      dlfdam1                        
                GET_TOPOLOGY            dlfdam1                      dlfdam1    

Can someone let me understand why it is not working with extracted fields and working with host field

0 Karma
1 Solution

PavelP
Motivator

try to first rename then coalesce

 index=fios 110788439127166000 
  |rename DELPHI_REQUEST.REQUEST.COMMAND as "COMMAND"
 | eval check=coalesce(SVC_ID,COMMAND)
 | table COMMAND ,host,SVC_ID,check

View solution in original post

0 Karma

PavelP
Motivator

try to first rename then coalesce

 index=fios 110788439127166000 
  |rename DELPHI_REQUEST.REQUEST.COMMAND as "COMMAND"
 | eval check=coalesce(SVC_ID,COMMAND)
 | table COMMAND ,host,SVC_ID,check
0 Karma

poddraj
Explorer

Thanks it worked. What I observed is due to . in my field name it is not working with coalesce function if I use same name replacing . with _ it is working like below

index=fios 110788439127166000
|rename DELPHI_REQUEST.REQUEST.COMMAND as "DELPHI_REQUEST_REQUEST_COMMAND"
| eval check=coalesce(SVC_ID,DELPHI_REQUEST_REQUEST_COMMAND)
| table DELPHI_REQUEST_REQUEST_COMMAND,host,SVC_ID,check

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Or you can try to use ‘FIELD.NAME’ instead of FIELD.NAME.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...