Splunk Search

How to evaluate multiple fields to create new field based on priority?

raysonjoberts
Path Finder

I am trying to create a logic to choose a value to use from multiple fields based on a priority I can define. I have 3 fields which may have values in them and I want to create a 4th field to represent the best best choice of the 3.


I always trust field3 more than field2 and always trust field2 more than field1.  I want the logic to be - 

- if field3 has value, always use it
-if field3 has no value, use field2's value
-if field3 and field2 have no values, use field1's value
- if fields3, 2 and 1 all have no values, leave blank (or "unknown", etc.)

These are 3 examples of what this may look like and what I want to see field4 be based on the presence of values in the other fields.

Example 1
field1=<value1>
field2=<value2>
field3=<value3>
field4=<value3>

Example 2
field1=<value1>
field2=<value2>
field3=
field4=<value2>

Example3
field1=<value1>
field2=
field3=
field4=<value1>

 

I feel like this is probably a pretty pretty simple eval command, but I can't seem to find an example.

Thank you in advance!

 

 

 

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| eval field4=coalesce(field3, field2, field1)

View solution in original post

0 Karma

raysonjoberts
Path Finder

I knew it was easy 😉

Thank you!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| eval field4=coalesce(field3, field2, field1)
0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...