Splunk Search

How to display default value in rex statements if the value is blank?

manojchacko78
Path Finder

Hi,

I am using the following script in Splunk query. Here i am trying having multiple values in field AdditionalData

and splitting them to extract the fields and writing to separate fields. Now if there is any blank value, in any of these extract fields, i want to have the default value appear as Not Available. 

Thanks in advance

| eval "AddtionalData"=if(isnotnull('cip:AuditMessage.ExtraData'),'cip:AuditMessage.ExtraData',"Not Available")
| rex field=AddtionalData "Legal employer name:(?<LegalEmployerName>[^,]+)"
| rex field=AddtionalData "Legal entity:(?<LegalEntity>[^,]+)"
| rex field=AddtionalData "Country:(?<Country>[^,]+)"
| rex field=AddtionalData "Business unit:(?<BusinessUnit>[^,]+)"

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @manojchacko78,

yu could try fill null:

<your_search>
| eval "AddtionalData"=if(isnotnull('cip:AuditMessage.ExtraData'),'cip:AuditMessage.ExtraData',"Not Available")
| rex field=AddtionalData "Legal employer name:(?<LegalEmployerName>[^,]*)"
| rex field=AddtionalData "Legal entity:(?<LegalEntity>[^,]*)"
| rex field=AddtionalData "Country:(?<Country>[^,]*)"
| rex field=AddtionalData "Business unit:(?<BusinessUnit>[^,]*)"
| fillnull value="Not  Available" LegalEmployerName
| fillnull value="Not  Available" LegalEntity
| fillnull value="Not  Available" Country
| fillnull value="Not  Available" BusinessUnit

remember in your regexes, to use "*" instead "+" when you could have no values.

Ciao.

Giuseppe

View solution in original post

manojchacko78
Path Finder

Thanks a lot @gcusello. You are an angel 🙂

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @manojchacko78,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @manojchacko78,

yu could try fill null:

<your_search>
| eval "AddtionalData"=if(isnotnull('cip:AuditMessage.ExtraData'),'cip:AuditMessage.ExtraData',"Not Available")
| rex field=AddtionalData "Legal employer name:(?<LegalEmployerName>[^,]*)"
| rex field=AddtionalData "Legal entity:(?<LegalEntity>[^,]*)"
| rex field=AddtionalData "Country:(?<Country>[^,]*)"
| rex field=AddtionalData "Business unit:(?<BusinessUnit>[^,]*)"
| fillnull value="Not  Available" LegalEmployerName
| fillnull value="Not  Available" LegalEntity
| fillnull value="Not  Available" Country
| fillnull value="Not  Available" BusinessUnit

remember in your regexes, to use "*" instead "+" when you could have no values.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...