Splunk Search

How to create a conditional eval to fill a new field depending on other fields?

lyds
Explorer

Hello,
I want to create a new field that will take the value of other fields depending of which one is filled.

For example, I have 5 fields but only one can be filled at a time. The other fields don't have any value.

Field1:
Field2:
Field3:
Field4: Ok
Field5:

How can I write the eval to check if a field1 is null, take the value of the following field2, if it is also null, take the value of field3 until it reaches the not null field?

Thank you.

0 Karma
1 Solution

nawazns5038
Builder

Try coalesce command

eval new_field=coalesce(Field1,Field2,....)

https://www.splunk.com/blog/2014/03/21/search-command-coalesce.html

View solution in original post

0 Karma

nawazns5038
Builder

Try coalesce command

eval new_field=coalesce(Field1,Field2,....)

https://www.splunk.com/blog/2014/03/21/search-command-coalesce.html

0 Karma

lyds
Explorer

I've used coalesce command, and I get what I wanted to display!

Thanks you all for the help!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@lyds, If your problem is resolved, please accept an answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this. The new field name will be called NewField and assumes your field name is field

| eval NewField=if(isnull(Field),"null",'Field')
0 Karma

inventsekar
Super Champion

Hi @skoelpin ... i think you missed the 5 fields part of the question..
--- I have 5 fields but only one can be filled at a time. The other fields don't have any value.

>>> Happy Splunking !
0 Karma

skoelpin
SplunkTrust
SplunkTrust

It's the same exact logic with a case statement...

0 Karma

RHASQaL
Path Finder

I think I'd use the coalesce eval function. It's description is 'This function takes an arbitrary number of arguments and returns the first value that is not NULL.'

0 Karma

inventsekar
Super Champion

with coalesce, try this one..
search Field="*" | eval NewField=coalesce(Field1, Field2, Field3, Field4, Field5) | eval result=if(NewField="Ok", "all good", "some fields are not null")

>>> Happy Splunking !
0 Karma

inventsekar
Super Champion

//// I have 5 fields but only one can be filled at a time. The other fields don't have any value ////
In your search use the fillnull command and assign a value to that field when it is null, then count that value for the field.

search Field="*" | fillnull value=NULL | stats count by Field | where count=1

Updated - with coalesce, try this one..

search Field="*" | eval NewField=coalesce(Field1, Field2, Field3, Field4, Field5) | eval result=if(NewField="Ok", "all good", "some fields are not null")

>>> Happy Splunking !
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!