Splunk Search

drop null value

riqbal47010
Path Finder

I have below query
index=f5 partition="/Common/-" | rex "Username\s+'(?(.*))'" | eval Username=coalesce(Username, user)

username is there but first attempt he left empty and in second try he add his username. so the Username is showing null values whereas the default user field is showing actual username.

I am using coalesce because I want to take either value but it should not be null. How can I achieve this.

0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

Function coalesce assigns the value of user field only if Username field does not exist in that event. But here it is set as empty string (""). Use if instead. below will sets value to user if Username is blank else sets to Username.

index=f5 partition="/Common/-" | rex "Username\s+'(?<Username>.*)'"| eval Username=if(Username == "",  user, Username)

View solution in original post

0 Karma

to4kawa
Ultra Champion
index=f5 partition="/Common/-" 
| rex "Username\s+'(?<Username>\w+)'" 
| eval Username=coalesce(Username, user)

your REGEX .* match null value.
How about this?
If Username has -, REGEX is [\w\-]+.

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Function coalesce assigns the value of user field only if Username field does not exist in that event. But here it is set as empty string (""). Use if instead. below will sets value to user if Username is blank else sets to Username.

index=f5 partition="/Common/-" | rex "Username\s+'(?<Username>.*)'"| eval Username=if(Username == "",  user, Username)
0 Karma

riqbal47010
Path Finder

alt text

0 Karma

riqbal47010
Path Finder

alt text

0 Karma

rmmiller
Contributor

Can you provide a sample event?
It sounds like your regular expression might not be working exactly as you expect.

0 Karma

riqbal47010
Path Finder

attaching for your kind consideration

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...