Splunk Search

NULLの場合に他のフィールドの値を代入したい

1014502
New Member

お世話になります。

以下のようなデータがあります。
issue.id,Key
1111 2222
null 3333

issue.idがNUllの場合Keyの値をissue.idに代入したいのですが、どのようにすればよろしいでしょうか。

0 Karma
1 Solution

HiroshiSatoh
Champion

これで良いと思います。

(your search)
| eval issue.id=if(isnull('issue.id'),Key,'issue.id')

View solution in original post

0 Karma

HiroshiSatoh
Champion

これで良いと思います。

(your search)
| eval issue.id=if(isnull('issue.id'),Key,'issue.id')
0 Karma

1014502
New Member

ありがとうございます。無事に解決しました

0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...