Splunk Search

Coalesce function not working with extracted fields

Explorer

Hi,

I am using below simple search where I am using coalesce to test.

index=fios 110788439127166000 
| eval check=coalesce(SVC_ID,DELPHI_REQUEST.REQUEST.COMMAND)
| table 
 DELPHI_REQUEST.REQUEST.COMMAND ,host,SVC_ID,check
 |rename DELPHI_REQUEST.REQUEST.COMMAND as "COMMAND"

I am getting below output where coalesce is not printing the value of field DELPHI_REQUEST.REQUEST.COMMAND instead it is printing null value.

                COMMAND                   host     SVC_ID         check
                ------------------------------------------------------------------------------------------
                GET_TOPOLOGY            dlfdam1                        
                GET_TOPOLOGY            dlfdam1                         

However, if I use below query coalesce is working fine.

index=fios 110788439127166000 
| eval check=coalesce(SVC_ID,host)
| table DELPHI_REQUEST.REQUEST.COMMAND ,host,SVC_ID,check
|rename DELPHI_REQUEST.REQUEST.COMMAND as "COMMAND"

                COMMAND                     host       SVC_ID      check
                ----------------------------------------------------------------------------------------
                GET_TOPOLOGY            dlfdam1                      dlfdam1                        
                GET_TOPOLOGY            dlfdam1                      dlfdam1    

Can someone let me understand why it is not working with extracted fields and working with host field

0 Karma
1 Solution

Motivator

try to first rename then coalesce

 index=fios 110788439127166000 
  |rename DELPHI_REQUEST.REQUEST.COMMAND as "COMMAND"
 | eval check=coalesce(SVC_ID,COMMAND)
 | table COMMAND ,host,SVC_ID,check

View solution in original post

0 Karma

Motivator

try to first rename then coalesce

 index=fios 110788439127166000 
  |rename DELPHI_REQUEST.REQUEST.COMMAND as "COMMAND"
 | eval check=coalesce(SVC_ID,COMMAND)
 | table COMMAND ,host,SVC_ID,check

View solution in original post

0 Karma

Explorer

Thanks it worked. What I observed is due to . in my field name it is not working with coalesce function if I use same name replacing . with _ it is working like below

index=fios 110788439127166000
|rename DELPHIREQUEST.REQUEST.COMMAND as "DELPHIREQUESTREQUESTCOMMAND"
| eval check=coalesce(SVCID,DELPHIREQUESTREQUESTCOMMAND)
| table DELPHIREQUESTREQUESTCOMMAND,host,SVCID,check

0 Karma

Champion

Or you can try to use ‘FIELD.NAME’ instead of FIELD.NAME.

0 Karma