eval if blank field

[jacqu3sy]

Hi,

Can I use multiple field values to substitute a blank value?

Currently have;

| eval final_destination = if(destination="", dest_ip, destination)\

How would I add additional fields to this command? so that if dest_ip was also blank, use dest_device instead?

[harsmarvania57 · Accepted solution]

Hi,

Try below query

<yoursearch>
| eval final_destination = if(destination="", if(dest_ip="", dest_device, dest_ip), destination)

You can try coalesce function in eval as well, have a look at https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/ConditionalFunctions#coalesce.28X...

[jacqu3sy]

star! thanks.