Splunk Search

How to set a token when the field exists?

timgren
Path Finder

I'm looking for a way to set a token when the column exists (regardless of value).  
Tried these with no luck. 

<eval token=if(isnotnull($row.MyCol$),useValue=$row.MyCol$,null())>
<eval token=case($row.MyCol$ != &quot;&quot; , useValue=$row.MyCol$) 

Thoughts? 

Labels (1)
0 Karma
1 Solution

timgren
Path Finder

Not quite, but that led me to one that does. 
<eval token="MyCol">if(isnotnull($row.MyCol$),"UseValue=".$row.MyCol$,"")</eval> 

 

Thanks! 

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@timgren 


You can also put logic in your search and display only the required columns by adding

| eval flag=if(isnull(MyCol),"0","1")
| eval flag_value=if(isnull(MyCol) AND MyCol!="" ,null(),MyCol)

 

and you can manage your tokens in drill down like this.

 

<drilldown>
          <condition match="$row.flag$=&quot;1&quot;">
            <set token="useValue">$row.flag_value$</set>
          </condition>
          <condition>
            <unset token="useValue" />
          </condition>
        </drilldown>

 

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you tried this?

<eval token=if(isnotnull($row.MyCol$), $row.MyCol$, null())>
---
If this reply helps you, Karma would be appreciated.

timgren
Path Finder

Not quite, but that led me to one that does. 
<eval token="MyCol">if(isnotnull($row.MyCol$),"UseValue=".$row.MyCol$,"")</eval> 

 

Thanks! 

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...