Splunk Search

How to create a conditional eval to fill a new field depending on other fields?

lyds
Explorer

Hello,
I want to create a new field that will take the value of other fields depending of which one is filled.

For example, I have 5 fields but only one can be filled at a time. The other fields don't have any value.

Field1:
Field2:
Field3:
Field4: Ok
Field5:

How can I write the eval to check if a field1 is null, take the value of the following field2, if it is also null, take the value of field3 until it reaches the not null field?

Thank you.

0 Karma
1 Solution

nawazns5038
Builder

Try coalesce command

eval new_field=coalesce(Field1,Field2,....)

https://www.splunk.com/blog/2014/03/21/search-command-coalesce.html

View solution in original post

0 Karma

nawazns5038
Builder

Try coalesce command

eval new_field=coalesce(Field1,Field2,....)

https://www.splunk.com/blog/2014/03/21/search-command-coalesce.html

0 Karma

lyds
Explorer

I've used coalesce command, and I get what I wanted to display!

Thanks you all for the help!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@lyds, If your problem is resolved, please accept an answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this. The new field name will be called NewField and assumes your field name is field

| eval NewField=if(isnull(Field),"null",'Field')
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @skoelpin ... i think you missed the 5 fields part of the question..
--- I have 5 fields but only one can be filled at a time. The other fields don't have any value.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

skoelpin
SplunkTrust
SplunkTrust

It's the same exact logic with a case statement...

0 Karma

RHASQaL
Path Finder

I think I'd use the coalesce eval function. It's description is 'This function takes an arbitrary number of arguments and returns the first value that is not NULL.'

0 Karma

inventsekar
SplunkTrust
SplunkTrust

with coalesce, try this one..
search Field="*" | eval NewField=coalesce(Field1, Field2, Field3, Field4, Field5) | eval result=if(NewField="Ok", "all good", "some fields are not null")

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

inventsekar
SplunkTrust
SplunkTrust

//// I have 5 fields but only one can be filled at a time. The other fields don't have any value ////
In your search use the fillnull command and assign a value to that field when it is null, then count that value for the field.

search Field="*" | fillnull value=NULL | stats count by Field | where count=1

Updated - with coalesce, try this one..

search Field="*" | eval NewField=coalesce(Field1, Field2, Field3, Field4, Field5) | eval result=if(NewField="Ok", "all good", "some fields are not null")

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...