drop null value

[riqbal47010]

I have below query
index=f5 partition="/Common/-" | rex "Username\s+'(?(.*))'" | eval Username=coalesce(Username, user)

username is there but first attempt he left empty and in second try he add his username. so the Username is showing null values whereas the default user field is showing actual username.

I am using coalesce because I want to take either value but it should not be null. How can I achieve this.

[to4kawa]

index=f5 partition="/Common/-" 
| rex "Username\s+'(?<Username>\w+)'" 
| eval Username=coalesce(Username, user)

your REGEX .* match null value.
How about this?
If Username has -, REGEX is [\w\-]+.

[manjunathmeti · Accepted solution]

Function coalesce assigns the value of user field only if Username field does not exist in that event. But here it is set as empty string (""). Use if instead. below will sets value to user if Username is blank else sets to Username.

index=f5 partition="/Common/-" | rex "Username\s+'(?<Username>.*)'"| eval Username=if(Username == "",  user, Username)

[riqbal47010]

[riqbal47010]

[rmmiller]

Can you provide a sample event?
It sounds like your regular expression might not be working exactly as you expect.

[riqbal47010]

attaching for your kind consideration