Splunk Search

Mvappend or Mvjoin only to fill blank spaces?

PTC_
Explorer

Hello, 

I want to append the results from one field to another, however, I only want to fill the null and blank spaces of the field. For this I tried the following:

| eval FIELD2= if(isnull(FIELD1) OR FIELD1="",mvappend(FIELD2,FIELD1),"")

What happens is that it will substitute the filled slots from FIELD2 with "", so it doesn't do what I need.

Is there any solution for this?

Labels (4)
0 Karma
1 Solution

PTC_
Explorer

Maybe I didn't explain it well but anyway I don't wish to obtain those results.
Dunno how can I explain it better but I used this command and it works for what I need to do:

| eval FIELD1= mvjoin(FIELD1,FIELD2)

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The eval command is doing what you told it to do - replace FIELD2 with an empty string if FIELD1 is not null or empty.

Before we can suggest an alternative command, please clarify the use case.  Using concrete, sanitized examples, please show what the output should be given some sample inputs.

---
If this reply helps you, Karma would be appreciated.
0 Karma

PTC_
Explorer

Let's say both fields look like this:

FIELD1FIELD2
 INFO2
 INFO3
INFO1INFO4


I want to append, for example, INFO2 and INFO3 to the blank spaces in FIELD1 and the command does that.
However, since "INFO1" fails the condition, it will be replaced with empty string, which I don't want to. The end result will look like this:

FIELD1FIELD2
INFO2INFO2
INFO3INFO3
 INFO4

 

In the end, I only want to fill FIELD1 blank spaces with FIELD2 information.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

As @richgalloway said, your illustrated code is trying to set FIELD2, as opposed to FIELD1 in your illustrated results.  To get your illustrated results, the left-hand side must be FIELD1, not FIELD2.

| eval FIELD1= if(isnull(FIELD1) OR FIELD1="",mvappend(FIELD2,FIELD1),"")

This said, why do you want to mvappend or mvjoin a field (FIELD1) that is verifiably blank?  Isn't an assignment of FIELD2 value simpler?

| eval FIELD1= if(isnull(FIELD1) OR FIELD1="", FIELD2,"")

 

0 Karma

PTC_
Explorer

Maybe I didn't explain it well but anyway I don't wish to obtain those results.
Dunno how can I explain it better but I used this command and it works for what I need to do:

| eval FIELD1= mvjoin(FIELD1,FIELD2)

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...