Splunk Search

drop null value

riqbal47010
Path Finder

I have below query
index=f5 partition="/Common/-" | rex "Username\s+'(?(.*))'" | eval Username=coalesce(Username, user)

username is there but first attempt he left empty and in second try he add his username. so the Username is showing null values whereas the default user field is showing actual username.

I am using coalesce because I want to take either value but it should not be null. How can I achieve this.

0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

Function coalesce assigns the value of user field only if Username field does not exist in that event. But here it is set as empty string (""). Use if instead. below will sets value to user if Username is blank else sets to Username.

index=f5 partition="/Common/-" | rex "Username\s+'(?<Username>.*)'"| eval Username=if(Username == "",  user, Username)

View solution in original post

0 Karma

to4kawa
Ultra Champion
index=f5 partition="/Common/-" 
| rex "Username\s+'(?<Username>\w+)'" 
| eval Username=coalesce(Username, user)

your REGEX .* match null value.
How about this?
If Username has -, REGEX is [\w\-]+.

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Function coalesce assigns the value of user field only if Username field does not exist in that event. But here it is set as empty string (""). Use if instead. below will sets value to user if Username is blank else sets to Username.

index=f5 partition="/Common/-" | rex "Username\s+'(?<Username>.*)'"| eval Username=if(Username == "",  user, Username)
0 Karma

riqbal47010
Path Finder

alt text

0 Karma

riqbal47010
Path Finder

alt text

0 Karma

rmmiller
Contributor

Can you provide a sample event?
It sounds like your regular expression might not be working exactly as you expect.

0 Karma

riqbal47010
Path Finder

attaching for your kind consideration

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...