Splunk Search

Look for field. If doesn't exist, add

Becherer
Explorer

I am looking to have a eval search that looks for a field name of "Name" and adds the value. If the field doesn't exist, I want to add a field of "Name" and add "N/A" for the data. 

 

| eval Name = if((like(Name,"*"))),"&Name&","N/A")

 

This might be the wrong way of doing it.

 

Event example #1:

HostnameTimeNameAction
Server0211:22amjdoelogon
Server201:30pmjsmithlogon

 

Event example #2:

HostnameTimeAction 
Workstation10:45amSaved 
Workstation 10012:30pmSaved 

 

 

After the search is run I want the data to look like this.

 

HostnameTimeNameAction
Server0211:22amjdoelogon
Server201:30pmjsmithlogon
Workstation10:45amN/ASave
Workstation 10012:30pmN/ASave
    
Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| fillnull value="N/A" Name
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...