Splunk Search

Look for field. If doesn't exist, add

Becherer
Explorer

I am looking to have a eval search that looks for a field name of "Name" and adds the value. If the field doesn't exist, I want to add a field of "Name" and add "N/A" for the data. 

 

| eval Name = if((like(Name,"*"))),"&Name&","N/A")

 

This might be the wrong way of doing it.

 

Event example #1:

HostnameTimeNameAction
Server0211:22amjdoelogon
Server201:30pmjsmithlogon

 

Event example #2:

HostnameTimeAction 
Workstation10:45amSaved 
Workstation 10012:30pmSaved 

 

 

After the search is run I want the data to look like this.

 

HostnameTimeNameAction
Server0211:22amjdoelogon
Server201:30pmjsmithlogon
Workstation10:45amN/ASave
Workstation 10012:30pmN/ASave
    
Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| fillnull value="N/A" Name
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...

Global Splunk User Group Events: May + June 2026

Your Splunk Community Awaits: Discover Upcoming User Group Events Worldwide    Staying ahead in the fast-paced ...