How to add values from a split to an existing field?

[fatanyk]

Hello, i'm trying to add values to an existing field but i'm running into a wall.

I have a field name vector and another field name source, the pattern of the source field is XXX - YYY - ZZZ,

i only want to keep the XXX part, so i've done

| eval temp = mvindex(split(source, " - "),0)

then i try to add these result to the vector field like this :

|eval vector = vector + temp

but it doesn't work.

Can you help me ?

[goncalocoelho · Accepted solution]

If vector doesn't exist, and you are creating it based on source, then try this:

| eval vector = if(isnull(temp), "<null or something else>", temp)

---
If this reply helps you, Karma would be appreciated.

[fatanyk]

it works thank you !

Actually it looks like this : 

| eval vector= if(isnull(temp),vector,temp)

[goncalocoelho]

Hi,

Do you know for sure if the source field exists in 100% of the events? Sometimes concatenating fields fails because one of the fields doesn't exist on all events.

Try this:

| eval vector = if(isnull(temp), vector, vector.temp)

Also try to concatenate using the "." instead of "+"

| eval vector = vector.temp

---
If this reply helps you, Karma would be appreciated.

[fatanyk]

No, the source field does not exist in 100% of the events, in fact I want to create the field "vector" for the events that do not have it with the value XXX.

i've try both of your solutions but neither worked.