Splunk Search

How to assign value to a field which is not present in some of the events and compare that value with other values from other events where that field is present?

abhi04
Communicator

How to assign value to a field which is not present in some of the events and compare that value with other values from other events where that field is present?

I have events where field named "SSLProxyEngine" have values "ON" or "OFF" for some of the events but for some events that field is not present. I want to assign value "NONE" to SSlProxyEngine where the field is not present and then compare this value with othere events value.

How can I do that?

Tags (1)
0 Karma

MuS
Legend

Hi abhi04,

first you run your search to get the events and add an eval statement to check if the field exists or not, and if not assign it the value. Try this:

 your search here
 | eval SSLProxyEngine = case(isnull(SSLProxyEngine), "NONE", isnotnull(SSLProxyEngine), SSLProxyEngine, 1=1, "unknown")

the last option is for events that does not match anything :winking_face:

Hope this helps ...

cheers, MuS

Sukisen1981
Champion

| eval yourfield=if(isnull(yourfield),"NONE",yourfield)

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...