Splunk Search

How to normalize events with multiple keys?

jrich523
Path Finder

I have a couple of fields, Node and NodeID, which will both have a number. Then I have NodeName which is of the format "Node001", so to make sure they all have a NodeName, I did this

eval NodeName="Node".substr("000".NodeId,-3) | eval NodeName = "Node".substr("000".Node,-3)

However, this seems rather wasteful. How would I combine this into one statement? It's unlikely an event will have both Node and NodeID, but I'd have to dig through the data more

0 Karma

sundareshr
Legend

Try this

.... | eval NodeName="Node".substr("000", coalesce(NodeId, Node), -3)
0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...