Use field A if B does not exist

[HeinzWaescher]

Hi,

in the past I used a lookup to add the field "price" to my events.
Now there will be a new field "price II" in the eventstructure. In the statistics I would like to tell Splunk to use "price II" if it exists, otherwise use "price"

My idea would be to create a new field "final_price" and use this field for further calculations. But I've no idea what kind of function should be used.

| eval final_price=...

Thanks in advance

Heinz

[martin_mueller]

Here's a shorter version:

... | eval final_price=coalesce(price_II,price) | ..

[HeinzWaescher]

This command works fine as well. Thanks!

[MuS · Accepted solution]

Hi HeinzWaescher,

check the isnotnull() or where function for eval, so you could use something like this:

 YourSearchHere | eval final_price=if(isnotnull(price II),price II,price)

But I'm not sure if this will work for you, because you're using a space in the fieldname. You should avoid spaces in field names and use _ or - instead.

hope this helps ...

cheers, MuS

[HeinzWaescher]

Hey,

this works fine! There is no space in the fieldname, it was just a bad example 😉

Thanks!

[alacercogitatus]

Splunk has a habit of replacing Spaces with underscores. Your field will probably be "price_II".