Splunk Search

how to sum two fields with empty values in some values of one field

Ahmedkhalil
Path Finder

Hello,

i have two fields and want to sum values of them in new field as below

new field = field1 + field2
i have added below expression in props.conf

EVAL-sum_Acct_input= (field1*4)+(field2/1073741824)
problem is that i found event coverage of new field sum_acct_input = event coverage of field1 as field one not exist in all events ( it has empty values ) so how can i overcome this issue ? and also how to make this expression at index time not search time

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

You can utilize "coalesce" function to handle empty/null values of field 1 like below

props.conf

EVAL-sum_Acct_input = (coalesce(field1,0)*4+(field2/1073741824)

Per my knowledge, calculated fields can't be created during index time.

View solution in original post

somesoni2
Revered Legend

You can utilize "coalesce" function to handle empty/null values of field 1 like below

props.conf

EVAL-sum_Acct_input = (coalesce(field1,0)*4+(field2/1073741824)

Per my knowledge, calculated fields can't be created during index time.

martin_mueller
SplunkTrust
SplunkTrust

coalesce(field1, field2) is a nicer way of writing if(isnotnull(field1), field1, field2) - basically, "take the first field from the list of arguments that isn't null".

Ahmedkhalil
Path Finder

thanks alot for your help i tested it and worked fine but may i know what excatly coalesce do ?

0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...