If one field null, populate another field with 0

[cooperjaram]

Hello Splunkers,

I have two fields that correlate. One field is hostname and another field is score. When I try to get an average of the score I get a incorrect value due to it calculating the score field even though the hostname is null and not representing anything. Is there a way to use if(isnull) or any other eval command so if hostname is null, it gives the other field the value of 0?

Thanks,

Cooper

[to4kawa]

your search
|stats avg(eval(if(isnull(hostname), null(), score))) as score_avg

[skoelpin]

Without seeing your results, it would look something like this

| eval hostname=if(isnull(score),0,'hostname')