Splunk Search

Eval Calculate fields with null values

cooperjaram
Engager

Hello, I am attempting to run the search below which works when all values are present "One, Two, Three, Four" but when one of the values aren't present and is null, the search wont work as the eval command | eval Other=(One)+(Two)+(Three)+(Four) wont run if not all four values are present. Is there a way to fill the null with 0 so the eval will still work? Ive attempted usenull=true and fillnull but doesn't seem to work.

index=myindex Survey_Answer5
| chart count over Survey_Question5 by Survey_Answer5
| rename 1 as "One" 2 as "Two" 3 as "Three" 4 as "Four" 5 as "WC"
| eval Other=(One)+(Two)+(Three)+(Four) | eval Total=WC+Other | eval wcPercentage=round(WC/Total,4)*100
| eval otherPercentage=round(Other/Total,4)*100 | eval wcPercentage=wcPercentage + "%" 
| eval otherPercentage=otherPercentage + "%"
| rename wcPercentage as "World Class" otherPercentage as "Other" Survey_Question5 as Question
| table Question "World Class" Other 
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi cooperjaram,
did you tried to use if condition in eval? something like this:

| eval Other=if(isnull(One),0,One)+if(isnull(Two),0,Two)+if(isnull(Three),0,Three)+if(isnull(Four),0,Four)

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi cooperjaram,
did you tried to use if condition in eval? something like this:

| eval Other=if(isnull(One),0,One)+if(isnull(Two),0,Two)+if(isnull(Three),0,Three)+if(isnull(Four),0,Four)

Bye.
Giuseppe

0 Karma

cooperjaram
Engager

This worked! Thank you.

0 Karma

Anantha123
Communicator

Hi,

Did you tried putting fillnull value=0 before | rename 1 as "One" 2 as "Two" 3 as "Three" 4 as "Four" 5 as "WC"

0 Karma

cooperjaram
Engager

Yeah I have. Still doesn't work. I suspect that the only way to make this work is going to be some eval trickery.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...