how to display raw result if no specific result is available?

[jalfrey]

I'm doing a pretty basic search which looks for a "connection closed" message and displays a variable called app. I have an automatic lookup which converts the app value to an application name. Not all of the values can be looked up in my lookup table. How do I run a search and display the application name (app_name) and if that's not available then display the app (numeric value)?

Here is the search I have made that calculates bytes sent/received and displays bot the app name and the app numeric value.

app=* "Connection Closed" | stats sum(sent) sum(rcvd) by dst_ip app | lookup sonicwall_app_id app_id as app OUTPUT app_name as Application | fields dst_ip, Application, app, sum(sent), sum(rcvd) | rename dst_ip as "Destination IP" | rename app to "App ID" | rename sum(sent) as "Bytes Sent" | rename sum(rcvd) as "Bytes Received"

[Ayn · Accepted solution]

Create a field that uses either the app_name if it's not null, otherwise use app_id:

... | eval yournewfield = coalesce(app_name, app_id) | ...

[Rob]

+1 on a nice use of coalesce!

[jalfrey]

my final search looks like:

index=sonicwall app=* "Connection Closed" | stats sum(sent) sum(rcvd) by dst_ip app | lookup sonicwall_app_id app_id as app OUTPUT app_name | eval "Application" = coalesce(app_name, app) | fields dst_ip, "Application", sum(sent), sum(rcvd) | rename dst_ip as "Destination" | rename sum(sent) as "Sent Bytes" | rename sum(rcvd) as "Received Bytes"

[jalfrey]

that worked great! Thanks.