Splunk Search

NULLの場合に他のフィールドの値を代入したい

1014502
New Member

お世話になります。

以下のようなデータがあります。
issue.id,Key
1111 2222
null 3333

issue.idがNUllの場合Keyの値をissue.idに代入したいのですが、どのようにすればよろしいでしょうか。

0 Karma
1 Solution

HiroshiSatoh
Champion

これで良いと思います。

(your search)
| eval issue.id=if(isnull('issue.id'),Key,'issue.id')

View solution in original post

0 Karma

HiroshiSatoh
Champion

これで良いと思います。

(your search)
| eval issue.id=if(isnull('issue.id'),Key,'issue.id')
0 Karma

1014502
New Member

ありがとうございます。無事に解決しました

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...