Splunk Search

eval if blank field

jacqu3sy
Path Finder

Hi,

Can I use multiple field values to substitute a blank value?

Currently have;

| eval final_destination = if(destination="", dest_ip, destination)\

How would I add additional fields to this command? so that if dest_ip was also blank, use dest_device instead?

Tags (1)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi,

Try below query

<yoursearch>
| eval final_destination = if(destination="", if(dest_ip="", dest_device, dest_ip), destination)

You can try coalesce function in eval as well, have a look at https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/ConditionalFunctions#coalesce.28X...

View solution in original post

0 Karma

harsmarvania57
Ultra Champion

Hi,

Try below query

<yoursearch>
| eval final_destination = if(destination="", if(dest_ip="", dest_device, dest_ip), destination)

You can try coalesce function in eval as well, have a look at https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/ConditionalFunctions#coalesce.28X...

0 Karma

jacqu3sy
Path Finder

star! thanks.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...