Splunk Search

How to add values from a split to an existing field?

fatanyk
Explorer

Hello, i'm trying to add values to an existing field but i'm running into a wall.

I have a field name vector and another field name source, the pattern of the source field is XXX - YYY - ZZZ,

i only want to keep the XXX part, so i've done

 

 

| eval temp = mvindex(split(source, " - "),0)

 

 

then i try to add these result to the vector field like this :

 

 

|eval vector = vector + temp

 

 

but it doesn't work.

 

Can you help me ?

Labels (1)
0 Karma
1 Solution

goncalocoelho
Path Finder

If vector doesn't exist, and you are creating it based on source, then try this:

| eval vector = if(isnull(temp), "<null or something else>", temp)

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

goncalocoelho
Path Finder

If vector doesn't exist, and you are creating it based on source, then try this:

| eval vector = if(isnull(temp), "<null or something else>", temp)

 

---
If this reply helps you, Karma would be appreciated.

fatanyk
Explorer

it works thank you !

Actually it looks like this : 

| eval vector= if(isnull(temp),vector,temp)
0 Karma

goncalocoelho
Path Finder

Hi,

Do you know for sure if the source field exists in 100% of the events? Sometimes concatenating fields fails because one of the fields doesn't exist on all events.

Try this:

| eval vector = if(isnull(temp), vector, vector.temp)

 

Also try to concatenate using the "." instead of "+"

| eval vector = vector.temp

 

---
If this reply helps you, Karma would be appreciated.

0 Karma

fatanyk
Explorer

No, the source field does not exist in 100% of the events, in fact I want to create the field "vector" for the events that do not have it with the value XXX.

 

i've try both of your solutions but neither worked.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...