Splunk Search

Splunk coalesce

yuvaraj_m91
Loves-to-Learn Lots

index="********"
message_type =ERROR correlation_id="*"
| eval err_field1 = spath(_raw,"response_details.body")
| eval err_field2 = spath(_raw,"response_details")
| eval err_field3 = spath(_raw,"error")
| eval err_field4 = spath(_raw,"message")
| eval err_final=coalesce(err_field1,err_field2,err_field3,err_field4)
| table err_field1 err_field2 err_field3 err_field4 err_final

i have the fields populating for err_field3 and err_field4.. but its not populating in the err_final.

Attached the screenshot for reference

splunk.jpg

Labels (1)
Tags (1)
0 Karma

dtburrows3
Builder

In these kinds of situations in Splunk I generally do something like this to replace empty strings with actual null values.

    | foreach err_field*
        [
            | eval
                <<FIELD>>=if(
                    '<<FIELD>>'=="" OR match('<<FIELD>>', "^\s*$"),
                        null(),
                        '<<FIELD>>'
                    )
            ]
    | eval
        err_final=coalesce(err_field1, err_field2, err_field3, err_field4)

 

dtburrows3_0-1703172241334.png


You can see the coalesce works as expected after replacing nullifying the empty strings.

Note: this is also replacing any values in the err_field* fields that is only whitespace in addition to empty strings.

richgalloway
SplunkTrust
SplunkTrust

It looks like err_field1contains an empty string.  If it was null then err_final would be set to err_field2 or err_field3.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...