Splunk Search

If one field null, populate another field with 0

cooperjaram
Engager

Hello Splunkers,

I have two fields that correlate. One field is hostname and another field is score. When I try to get an average of the score I get a incorrect value due to it calculating the score field even though the hostname is null and not representing anything. Is there a way to use if(isnull) or any other eval command so if hostname is null, it gives the other field the value of 0?

Thanks,

Cooper

0 Karma

to4kawa
Ultra Champion
your search
|stats avg(eval(if(isnull(hostname), null(), score))) as score_avg
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Without seeing your results, it would look something like this

| eval hostname=if(isnull(score),0,'hostname')
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!