Splunk Search

How to create a conditional eval to fill a new field depending on other fields?

Explorer

Hello,
I want to create a new field that will take the value of other fields depending of which one is filled.

For example, I have 5 fields but only one can be filled at a time. The other fields don't have any value.

Field1:
Field2:
Field3:
Field4: Ok
Field5:

How can I write the eval to check if a field1 is null, take the value of the following field2, if it is also null, take the value of field3 until it reaches the not null field?

Thank you.

0 Karma
1 Solution

Builder

Try coalesce command

eval new_field=coalesce(Field1,Field2,....)

https://www.splunk.com/blog/2014/03/21/search-command-coalesce.html

View solution in original post

0 Karma

Builder

Try coalesce command

eval new_field=coalesce(Field1,Field2,....)

https://www.splunk.com/blog/2014/03/21/search-command-coalesce.html

View solution in original post

0 Karma

Explorer

I've used coalesce command, and I get what I wanted to display!

Thanks you all for the help!

0 Karma

SplunkTrust
SplunkTrust

@lyds, If your problem is resolved, please accept an answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

SplunkTrust
SplunkTrust

Try this. The new field name will be called NewField and assumes your field name is field

| eval NewField=if(isnull(Field),"null",'Field')
0 Karma

Super Champion

Hi @skoelpin ... i think you missed the 5 fields part of the question..
--- I have 5 fields but only one can be filled at a time. The other fields don't have any value.

0 Karma

SplunkTrust
SplunkTrust

It's the same exact logic with a case statement...

0 Karma

Path Finder

I think I'd use the coalesce eval function. It's description is 'This function takes an arbitrary number of arguments and returns the first value that is not NULL.'

0 Karma

Super Champion

with coalesce, try this one..
search Field="*" | eval NewField=coalesce(Field1, Field2, Field3, Field4, Field5) | eval result=if(NewField="Ok", "all good", "some fields are not null")

0 Karma

Super Champion

//// I have 5 fields but only one can be filled at a time. The other fields don't have any value ////
In your search use the fillnull command and assign a value to that field when it is null, then count that value for the field.

search Field="*" | fillnull value=NULL | stats count by Field | where count=1

Updated - with coalesce, try this one..

search Field="*" | eval NewField=coalesce(Field1, Field2, Field3, Field4, Field5) | eval result=if(NewField="Ok", "all good", "some fields are not null")

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!