Splunk Search

How to populate a null field if certain field equals ***

smithjnick
Path Finder

Hi Folks

Have an issue where some of my log entries contain null fields in which i need to populate in order to run stats against.

From the csv dump below, dest_port is empty so i need to basically say:

where rule=SSH-ACL, polulate empty dest_port field with a value of 22
where rule=NTP-ACL, polulate empty dest_port field with a value of 123

thanks in advance.

alt text

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try case.

... | eval dest_port = case (rule=SSH-ACL AND isnull(dest_port), 22, rule=NTP-ACL AND isnull(dest_port), 123, 1==1, dest_port)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try case.

... | eval dest_port = case (rule=SSH-ACL AND isnull(dest_port), 22, rule=NTP-ACL AND isnull(dest_port), 123, 1==1, dest_port)
---
If this reply helps you, Karma would be appreciated.
0 Karma

jpalacian
Path Finder

Well, I'd use this slightly modified version

 ... | eval dest_port = case (rule="SSH-ACL" AND isnull(dest_port), 22, rule="NTP-ACL" AND isnull(dest_port), 123, 1==1, dest_port)

smithjnick
Path Finder

Yep JP - that fixed the issue - those damn quotation marks.

thank you muchly and have a great weekend.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Should there be at the end “,1=1, dest_port)” ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes. Updated.

---
If this reply helps you, Karma would be appreciated.
0 Karma

smithjnick
Path Finder

Thank you Rich.

Not currently giving me the desired output but the case command has now given me some food for thought. Thank you for the pointer and will report back with my outcome.

cheers

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...