Splunk Search

Use field A if B does not exist

HeinzWaescher
Motivator

Hi,

in the past I used a lookup to add the field "price" to my events.
Now there will be a new field "price II" in the eventstructure. In the statistics I would like to tell Splunk to use "price II" if it exists, otherwise use "price"

My idea would be to create a new field "final_price" and use this field for further calculations. But I've no idea what kind of function should be used.

| eval final_price=...

Thanks in advance

Heinz

Tags (2)
1 Solution

MuS
Legend

Hi HeinzWaescher,

check the isnotnull() or where function for eval, so you could use something like this:

 YourSearchHere | eval final_price=if(isnotnull(price II),price II,price)

But I'm not sure if this will work for you, because you're using a space in the fieldname. You should avoid spaces in field names and use _ or - instead.

hope this helps ...

cheers, MuS

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Here's a shorter version:

... | eval final_price=coalesce(price_II,price) | ..

HeinzWaescher
Motivator

This command works fine as well. Thanks!

0 Karma

MuS
Legend

Hi HeinzWaescher,

check the isnotnull() or where function for eval, so you could use something like this:

 YourSearchHere | eval final_price=if(isnotnull(price II),price II,price)

But I'm not sure if this will work for you, because you're using a space in the fieldname. You should avoid spaces in field names and use _ or - instead.

hope this helps ...

cheers, MuS

HeinzWaescher
Motivator

Hey,

this works fine! There is no space in the fieldname, it was just a bad example 😉

Thanks!

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Splunk has a habit of replacing Spaces with underscores. Your field will probably be "price_II".

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...