Splunk Search

Mvappend or Mvjoin only to fill blank spaces?

PTC_
Explorer

Hello, 

I want to append the results from one field to another, however, I only want to fill the null and blank spaces of the field. For this I tried the following:

| eval FIELD2= if(isnull(FIELD1) OR FIELD1="",mvappend(FIELD2,FIELD1),"")

What happens is that it will substitute the filled slots from FIELD2 with "", so it doesn't do what I need.

Is there any solution for this?

Labels (4)
0 Karma
1 Solution

PTC_
Explorer

Maybe I didn't explain it well but anyway I don't wish to obtain those results.
Dunno how can I explain it better but I used this command and it works for what I need to do:

| eval FIELD1= mvjoin(FIELD1,FIELD2)

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The eval command is doing what you told it to do - replace FIELD2 with an empty string if FIELD1 is not null or empty.

Before we can suggest an alternative command, please clarify the use case.  Using concrete, sanitized examples, please show what the output should be given some sample inputs.

---
If this reply helps you, Karma would be appreciated.
0 Karma

PTC_
Explorer

Let's say both fields look like this:

FIELD1FIELD2
 INFO2
 INFO3
INFO1INFO4


I want to append, for example, INFO2 and INFO3 to the blank spaces in FIELD1 and the command does that.
However, since "INFO1" fails the condition, it will be replaced with empty string, which I don't want to. The end result will look like this:

FIELD1FIELD2
INFO2INFO2
INFO3INFO3
 INFO4

 

In the end, I only want to fill FIELD1 blank spaces with FIELD2 information.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

As @richgalloway said, your illustrated code is trying to set FIELD2, as opposed to FIELD1 in your illustrated results.  To get your illustrated results, the left-hand side must be FIELD1, not FIELD2.

| eval FIELD1= if(isnull(FIELD1) OR FIELD1="",mvappend(FIELD2,FIELD1),"")

This said, why do you want to mvappend or mvjoin a field (FIELD1) that is verifiably blank?  Isn't an assignment of FIELD2 value simpler?

| eval FIELD1= if(isnull(FIELD1) OR FIELD1="", FIELD2,"")

 

0 Karma

PTC_
Explorer

Maybe I didn't explain it well but anyway I don't wish to obtain those results.
Dunno how can I explain it better but I used this command and it works for what I need to do:

| eval FIELD1= mvjoin(FIELD1,FIELD2)

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...