Splunk Search

How to normalize events with multiple keys?

jrich523
Path Finder

I have a couple of fields, Node and NodeID, which will both have a number. Then I have NodeName which is of the format "Node001", so to make sure they all have a NodeName, I did this

eval NodeName="Node".substr("000".NodeId,-3) | eval NodeName = "Node".substr("000".Node,-3)

However, this seems rather wasteful. How would I combine this into one statement? It's unlikely an event will have both Node and NodeID, but I'd have to dig through the data more

0 Karma

sundareshr
Legend

Try this

.... | eval NodeName="Node".substr("000", coalesce(NodeId, Node), -3)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!