Splunk Search

How to replace field value of one event with another event?

FaridHamidi
Engager

Annotation 2020-07-23 120100.png

This is the data set from Fundamental 1.

A lot of successful purchase events with same 'ProductName' doesn't include 'categoryId' as a field. So I want to put/replace the null 'categoryId' field with 'categoryId' which have the same 'ProductName'. How do I do it and scale it up to multiple events?

For example, I want the Null value in the screenshot above replaced by the categoryId of the same ProductName.

I hope I word this out clearly. Thank you in advance.

Labels (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

I am assuming your example shows the word "Null" as the text value rather than Splunk 'null', so in that case, this is an example where I have shown your data plus a couple of additional games to demonstrate the point.

|  makeresults
|  eval _raw="ProductName,categoryId
Benign Space Debris,Arcade
Orvil The Wolverine,Arcade
Some Other Game,Board
Another New Game,Null
Orvil The Wolverine,Null
Another New Game,Ball
Benign Space Debris,Null
Some Other Game,Null"
|  multikv forceheader=1
|  table ProductName categoryId
|  rename "COMMENT" as "Above this line is your data setup"
|  eval categoryId=nullif(categoryId, "Null")
|  sort ProductName, categoryId
|  filldown categoryId

This works by ensuring that the text "Null" is converted to a Splunk null and then sorts the data by ProductName and categoryId, which is ensuring that the null entries are at the end of the product name.

It then uses filldown to take a current categoryId and places it in subsequent null records below.

Hope this helps.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

I am assuming your example shows the word "Null" as the text value rather than Splunk 'null', so in that case, this is an example where I have shown your data plus a couple of additional games to demonstrate the point.

|  makeresults
|  eval _raw="ProductName,categoryId
Benign Space Debris,Arcade
Orvil The Wolverine,Arcade
Some Other Game,Board
Another New Game,Null
Orvil The Wolverine,Null
Another New Game,Ball
Benign Space Debris,Null
Some Other Game,Null"
|  multikv forceheader=1
|  table ProductName categoryId
|  rename "COMMENT" as "Above this line is your data setup"
|  eval categoryId=nullif(categoryId, "Null")
|  sort ProductName, categoryId
|  filldown categoryId

This works by ensuring that the text "Null" is converted to a Splunk null and then sorts the data by ProductName and categoryId, which is ensuring that the null entries are at the end of the product name.

It then uses filldown to take a current categoryId and places it in subsequent null records below.

Hope this helps.

 

Get Updates on the Splunk Community!

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...