Splunk Search

Use field A if B does not exist

HeinzWaescher
Motivator

Hi,

in the past I used a lookup to add the field "price" to my events.
Now there will be a new field "price II" in the eventstructure. In the statistics I would like to tell Splunk to use "price II" if it exists, otherwise use "price"

My idea would be to create a new field "final_price" and use this field for further calculations. But I've no idea what kind of function should be used.

| eval final_price=...

Thanks in advance

Heinz

Tags (2)
1 Solution

MuS
Legend

Hi HeinzWaescher,

check the isnotnull() or where function for eval, so you could use something like this:

 YourSearchHere | eval final_price=if(isnotnull(price II),price II,price)

But I'm not sure if this will work for you, because you're using a space in the fieldname. You should avoid spaces in field names and use _ or - instead.

hope this helps ...

cheers, MuS

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Here's a shorter version:

... | eval final_price=coalesce(price_II,price) | ..

HeinzWaescher
Motivator

This command works fine as well. Thanks!

0 Karma

MuS
Legend

Hi HeinzWaescher,

check the isnotnull() or where function for eval, so you could use something like this:

 YourSearchHere | eval final_price=if(isnotnull(price II),price II,price)

But I'm not sure if this will work for you, because you're using a space in the fieldname. You should avoid spaces in field names and use _ or - instead.

hope this helps ...

cheers, MuS

HeinzWaescher
Motivator

Hey,

this works fine! There is no space in the fieldname, it was just a bad example 😉

Thanks!

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Splunk has a habit of replacing Spaces with underscores. Your field will probably be "price_II".

0 Karma
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...