Splunk Search

eval isnull

subtrakt
Contributor

Hi!

Anyone know why i'm still getting NULL in my timechart?

The lookup "existing" has two columns "ticket|host_message". host_message column matches the eval expression host+CISCO_MESSAGE below... I **can get the host+message+ticket number to show up in the timechart with the following query - however if the results do not match host_message in the lookup, hostTICKET comes back null.** I want null to simply be host_message without the ticket because it does not exist on the lookup.

index=net | rex "(?i)^([^:]*:){8}(?<CISCO_LOG>.*)$" | eval host_message=host+CISCO_LOG | lookup existing host_message |  eval hostTICKET=if(isnull(hostTICKET),host_message+" "+TICKET,host_message) | timechart count by hostTICKET
Tags (3)

_brettfitz
Observer

The above eval statement does not correctly convert 0 to 0.0.0.0 and null values. Try this:

Note: replace ip with the field name you would like to convert.

 

| eval o1=floor(ip/16777216) | eval o2=floor((ip-o1*16777216)/65536) | eval o3=floor((ip-(o1*16777216+o2*65536))/256)| eval o4=ip-(o1*16777216+o2*65536+o3*256) | eval ipv4=tostring(o1)+"."+tostring(o2)+"."+tostring(o3)+"."+tostring(o4) | eval ipv4=if(ipv4="Null.Null.Null.Null","",ipv4)

 

 

0 Karma

Ayn
Legend

You're using the wrong operator for performing string concatenations. It should be ".", not "+". So, your eval statement should read

eval hostTicket=if(isnull(hostTICKET),host_message." ".TICKET,host_message

somesoni2
SplunkTrust
SplunkTrust

Where is the field "hostTICKET" present? Its not coming from lookup right? Is it there in the logs?

0 Karma

lukejadamec
Super Champion

No. NULL is being filled in by the lookup statement, so when it gets to the eval the values is NULL, which is not null.

0 Karma

subtrakt
Contributor

It is still coming back as NULL for messages that are not defined in the lookup. the field after "isnull" in parentheses is supposed to be the field that could come back as null correct?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...