Splunk Search

How to evaluate multiple fields to create new field based on priority?

raysonjoberts
Explorer

I am trying to create a logic to choose a value to use from multiple fields based on a priority I can define. I have 3 fields which may have values in them and I want to create a 4th field to represent the best best choice of the 3.


I always trust field3 more than field2 and always trust field2 more than field1.  I want the logic to be - 

- if field3 has value, always use it
-if field3 has no value, use field2's value
-if field3 and field2 have no values, use field1's value
- if fields3, 2 and 1 all have no values, leave blank (or "unknown", etc.)

These are 3 examples of what this may look like and what I want to see field4 be based on the presence of values in the other fields.

Example 1
field1=<value1>
field2=<value2>
field3=<value3>
field4=<value3>

Example 2
field1=<value1>
field2=<value2>
field3=
field4=<value2>

Example3
field1=<value1>
field2=
field3=
field4=<value1>

 

I feel like this is probably a pretty pretty simple eval command, but I can't seem to find an example.

Thank you in advance!

 

 

 

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| eval field4=coalesce(field3, field2, field1)

View solution in original post

0 Karma

raysonjoberts
Explorer

I knew it was easy 😉

Thank you!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| eval field4=coalesce(field3, field2, field1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...