Splunk Search

How to normalize events with multiple keys?

jrich523
Path Finder

I have a couple of fields, Node and NodeID, which will both have a number. Then I have NodeName which is of the format "Node001", so to make sure they all have a NodeName, I did this

eval NodeName="Node".substr("000".NodeId,-3) | eval NodeName = "Node".substr("000".Node,-3)

However, this seems rather wasteful. How would I combine this into one statement? It's unlikely an event will have both Node and NodeID, but I'd have to dig through the data more

0 Karma

sundareshr
Legend

Try this

.... | eval NodeName="Node".substr("000", coalesce(NodeId, Node), -3)
0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...