Splunk Search

Mvappend or Mvjoin only to fill blank spaces?

PTC_
Explorer

Hello, 

I want to append the results from one field to another, however, I only want to fill the null and blank spaces of the field. For this I tried the following:

| eval FIELD2= if(isnull(FIELD1) OR FIELD1="",mvappend(FIELD2,FIELD1),"")

What happens is that it will substitute the filled slots from FIELD2 with "", so it doesn't do what I need.

Is there any solution for this?

Labels (4)
0 Karma
1 Solution

PTC_
Explorer

Maybe I didn't explain it well but anyway I don't wish to obtain those results.
Dunno how can I explain it better but I used this command and it works for what I need to do:

| eval FIELD1= mvjoin(FIELD1,FIELD2)

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The eval command is doing what you told it to do - replace FIELD2 with an empty string if FIELD1 is not null or empty.

Before we can suggest an alternative command, please clarify the use case.  Using concrete, sanitized examples, please show what the output should be given some sample inputs.

---
If this reply helps you, Karma would be appreciated.
0 Karma

PTC_
Explorer

Let's say both fields look like this:

FIELD1FIELD2
 INFO2
 INFO3
INFO1INFO4


I want to append, for example, INFO2 and INFO3 to the blank spaces in FIELD1 and the command does that.
However, since "INFO1" fails the condition, it will be replaced with empty string, which I don't want to. The end result will look like this:

FIELD1FIELD2
INFO2INFO2
INFO3INFO3
 INFO4

 

In the end, I only want to fill FIELD1 blank spaces with FIELD2 information.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

As @richgalloway said, your illustrated code is trying to set FIELD2, as opposed to FIELD1 in your illustrated results.  To get your illustrated results, the left-hand side must be FIELD1, not FIELD2.

| eval FIELD1= if(isnull(FIELD1) OR FIELD1="",mvappend(FIELD2,FIELD1),"")

This said, why do you want to mvappend or mvjoin a field (FIELD1) that is verifiably blank?  Isn't an assignment of FIELD2 value simpler?

| eval FIELD1= if(isnull(FIELD1) OR FIELD1="", FIELD2,"")

 

0 Karma

PTC_
Explorer

Maybe I didn't explain it well but anyway I don't wish to obtain those results.
Dunno how can I explain it better but I used this command and it works for what I need to do:

| eval FIELD1= mvjoin(FIELD1,FIELD2)

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...