Set Field=Value when Field not present in some logs

[bcarr12]

Hi all,

I am running a search that in some cases has:
Field=Values

In other cases, Field is completely missing from logs (this is expected).

What would be the best way to set Field equal to the Value when one is present, but if the Field does not exist in a given log line, Field should be set to the word "none"?

I've tried the coalesce command, but it doesn't seem to be working - maybe it is just being used incorrectly?
eval NewField=coalesce(Field,"none")

In the above example, NewField is always equal to "none" - even when Field includes a value.

[bcarr12]

Thank you both for your suggestions! alemarzu, fillnull worked great for this!

[alemarzu · Accepted solution]

Heya, or try this.

... | fillnull value=none field1,field2,field3

[cmerriman]

try this:

|eval Field=if(isnull(Field),"none",Field)