Splunk Search

How to populate a null field if certain field equals ***

smithjnick
Path Finder

Hi Folks

Have an issue where some of my log entries contain null fields in which i need to populate in order to run stats against.

From the csv dump below, dest_port is empty so i need to basically say:

where rule=SSH-ACL, polulate empty dest_port field with a value of 22
where rule=NTP-ACL, polulate empty dest_port field with a value of 123

thanks in advance.

alt text

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try case.

... | eval dest_port = case (rule=SSH-ACL AND isnull(dest_port), 22, rule=NTP-ACL AND isnull(dest_port), 123, 1==1, dest_port)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try case.

... | eval dest_port = case (rule=SSH-ACL AND isnull(dest_port), 22, rule=NTP-ACL AND isnull(dest_port), 123, 1==1, dest_port)
---
If this reply helps you, Karma would be appreciated.
0 Karma

jpalacian
Path Finder

Well, I'd use this slightly modified version

 ... | eval dest_port = case (rule="SSH-ACL" AND isnull(dest_port), 22, rule="NTP-ACL" AND isnull(dest_port), 123, 1==1, dest_port)

smithjnick
Path Finder

Yep JP - that fixed the issue - those damn quotation marks.

thank you muchly and have a great weekend.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Should there be at the end “,1=1, dest_port)” ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes. Updated.

---
If this reply helps you, Karma would be appreciated.
0 Karma

smithjnick
Path Finder

Thank you Rich.

Not currently giving me the desired output but the case command has now given me some food for thought. Thank you for the pointer and will report back with my outcome.

cheers

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...