Splunk Search

NULLの場合に他のフィールドの値を代入したい

1014502
New Member

お世話になります。

以下のようなデータがあります。
issue.id,Key
1111 2222
null 3333

issue.idがNUllの場合Keyの値をissue.idに代入したいのですが、どのようにすればよろしいでしょうか。

0 Karma
1 Solution

HiroshiSatoh
Champion

これで良いと思います。

(your search)
| eval issue.id=if(isnull('issue.id'),Key,'issue.id')

View solution in original post

0 Karma

HiroshiSatoh
Champion

これで良いと思います。

(your search)
| eval issue.id=if(isnull('issue.id'),Key,'issue.id')
0 Karma

1014502
New Member

ありがとうございます。無事に解決しました

0 Karma
Get Updates on the Splunk Community!

Observability Unveiled: Navigating OpenTelemetry's Framework and Deployment Options

Observability Unveiled: Navigating OpenTelemetry's Framework and Deployment Options A recent Tech Talk, ...

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...