Hi Folks
Have an issue where some of my log entries contain null fields in which i need to populate in order to run stats against.
From the csv dump below, dest_port is empty so i need to basically say:
where rule=SSH-ACL, polulate empty dest_port field with a value of 22
where rule=NTP-ACL, polulate empty dest_port field with a value of 123
thanks in advance.
Try case
.
... | eval dest_port = case (rule=SSH-ACL AND isnull(dest_port), 22, rule=NTP-ACL AND isnull(dest_port), 123, 1==1, dest_port)
Try case
.
... | eval dest_port = case (rule=SSH-ACL AND isnull(dest_port), 22, rule=NTP-ACL AND isnull(dest_port), 123, 1==1, dest_port)
Well, I'd use this slightly modified version
... | eval dest_port = case (rule="SSH-ACL" AND isnull(dest_port), 22, rule="NTP-ACL" AND isnull(dest_port), 123, 1==1, dest_port)
Yep JP - that fixed the issue - those damn quotation marks.
thank you muchly and have a great weekend.
Should there be at the end “,1=1, dest_port)” ?
Yes. Updated.
Thank you Rich.
Not currently giving me the desired output but the case command has now given me some food for thought. Thank you for the pointer and will report back with my outcome.
cheers