Splunk Search

If one field null, populate another field with 0

cooperjaram
Engager

Hello Splunkers,

I have two fields that correlate. One field is hostname and another field is score. When I try to get an average of the score I get a incorrect value due to it calculating the score field even though the hostname is null and not representing anything. Is there a way to use if(isnull) or any other eval command so if hostname is null, it gives the other field the value of 0?

Thanks,

Cooper

0 Karma

to4kawa
SplunkTrust
SplunkTrust
your search
|stats avg(eval(if(isnull(hostname), null(), score))) as score_avg
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Without seeing your results, it would look something like this

| eval hostname=if(isnull(score),0,'hostname')
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!