Splunk Search

Coalesce function not working with extracted fields

Explorer

Hi,

I am using below simple search where I am using coalesce to test.

index=fios 110788439127166000 
| eval check=coalesce(SVC_ID,DELPHI_REQUEST.REQUEST.COMMAND)
| table 
 DELPHI_REQUEST.REQUEST.COMMAND ,host,SVC_ID,check
 |rename DELPHI_REQUEST.REQUEST.COMMAND as "COMMAND"

I am getting below output where coalesce is not printing the value of field DELPHI_REQUEST.REQUEST.COMMAND instead it is printing null value.

                COMMAND                   host     SVC_ID         check
                ------------------------------------------------------------------------------------------
                GET_TOPOLOGY            dlfdam1                        
                GET_TOPOLOGY            dlfdam1                         

However, if I use below query coalesce is working fine.

index=fios 110788439127166000 
| eval check=coalesce(SVC_ID,host)
| table DELPHI_REQUEST.REQUEST.COMMAND ,host,SVC_ID,check
|rename DELPHI_REQUEST.REQUEST.COMMAND as "COMMAND"

                COMMAND                     host       SVC_ID      check
                ----------------------------------------------------------------------------------------
                GET_TOPOLOGY            dlfdam1                      dlfdam1                        
                GET_TOPOLOGY            dlfdam1                      dlfdam1    

Can someone let me understand why it is not working with extracted fields and working with host field

0 Karma
1 Solution

Motivator

try to first rename then coalesce

 index=fios 110788439127166000 
  |rename DELPHI_REQUEST.REQUEST.COMMAND as "COMMAND"
 | eval check=coalesce(SVC_ID,COMMAND)
 | table COMMAND ,host,SVC_ID,check

View solution in original post

0 Karma

Motivator

try to first rename then coalesce

 index=fios 110788439127166000 
  |rename DELPHI_REQUEST.REQUEST.COMMAND as "COMMAND"
 | eval check=coalesce(SVC_ID,COMMAND)
 | table COMMAND ,host,SVC_ID,check

View solution in original post

0 Karma

Explorer

Thanks it worked. What I observed is due to . in my field name it is not working with coalesce function if I use same name replacing . with _ it is working like below

index=fios 110788439127166000
|rename DELPHI_REQUEST.REQUEST.COMMAND as "DELPHI_REQUEST_REQUEST_COMMAND"
| eval check=coalesce(SVC_ID,DELPHI_REQUEST_REQUEST_COMMAND)
| table DELPHI_REQUEST_REQUEST_COMMAND,host,SVC_ID,check

0 Karma

SplunkTrust
SplunkTrust

Or you can try to use ‘FIELD.NAME’ instead of FIELD.NAME.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!