Substitute a value in the search result

[ppurokit]

I have a search result which returns me the following

Username,TimeOnVPN
user1,185.25
user2,1920.25
...
...
...
user6,
user7,

sourcetype="***" | rex "Duration:\s+((?\d+)d\s)?(?\d+)h:(?\d+)m:(?\d+)s," | eval total=round(((days*1440)+(hour*60)+(min)+(sec)/60),2) *|eval total_min = if(total =="",0,total) | stats sum(total_min) as TimeOnVPN by Username

Here if you take user6 and user7 does not have a value which means like i need to substitute "0" for it. I tried the eval function which i have bolded and it's not working as expected.

Please let me know how to achieve it.

[somesoni2]

You can try changing your search-eval as mentioned below:-

sourcetype="" | rex "Duration:s+((?d+)ds)?(?d+)h:(?d+)m:(?d+)s," | eval total=round(((days1440)+(hour*60)+(min)+(sec)/60),2) *|eval total_min = coalesce(total,0)** | stats sum(total_min) as TimeOnVPN by Username

Coalesce function will take first non null value from total or 0.

[jspears · Accepted solution]

You could try fillnull: http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Fillnull

| fillnull value=0

This will fill any existing field that is null with the value "0"

| fillnull value=0 total

This will fill only the field named "total" with "0"