Help with replacing values

[jameskerivan]

Hi,

I have my output I was looking for, but was wondering if there was a cleaner way to do it. Basically I have a field like such f1||f2||f3||f4. f2 and f3 can be null in some cases. If they are null I wanted to replace them with my own string. right now i have this as my query.

rex field=transaction_type "(?<TransferType>.)||(?<FromAcct>.)||(?<ToAcct>.)||(?<When>.)"
| eval FromAcct = if(FromAcct="null", "Non" ,FromAcct)
| eval ToAcct = if(ToAcct="null", "Non" ,ToAcct)
| stats count by TransferType, FromAcct, ToAcct, When
| sort count desc

Now I dont like that i have two evals cases where I use if. I wanted to use eval case but wasn't able to get it to work because of how I parse my field.

Thanks for the help!

Thanks!

[woodcock · Accepted solution]

Like this:

rex field=transaction_type "(?<TransferType>.)||(?<FromAcct>.)||(?<ToAcct>.)||(?<When>.)"
| replace "null" WITH "Non" IN ToAcct FromAcct
| stats count by TransferType, FromAcct, ToAcct, When
| sort count desc

[jameskerivan]

Thank you!

[gcato]

Hi jameskerivan,

Have you seen the fillnull command. it can replace nulls with a value. Refer to: http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Fillnull

Hope this helps.

[aljohnson_splun]

Yeah, but he is matching a literal string null - the values aren't actually null, they're filled with a literal value, which just happens to be the string, null. So the fillnull command sadly won't work here.

[gcato]

Yes, very true. I'd suggest the rex command then.
...| rex mode=sed field=_raw "s/null/Non/g" |rex field=transaction_type ...
Note: Must happen before the rex field extraction