Solved: Re: eval if blank field - Splunk Community

Splunk Search

Hi,

Can I use multiple field values to substitute a blank value?

Currently have;

| eval final_destination = if(destination="", dest_ip, destination)\

How would I add additional fields to this command? so that if dest_ip was also blank, use dest_device instead?

1 Solution

Solution

Hi,

Try below query

<yoursearch>
| eval final_destination = if(destination="", if(dest_ip="", dest_device, dest_ip), destination)

You can try coalesce function in eval as well, have a look at https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/ConditionalFunctions#coalesce.28X...

View solution in original post

Solution

Hi,

Try below query

<yoursearch>
| eval final_destination = if(destination="", if(dest_ip="", dest_device, dest_ip), destination)

You can try coalesce function in eval as well, have a look at https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/ConditionalFunctions#coalesce.28X...

star! thanks.

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...