Hello,
i have two fields and want to sum values of them in new field as below
new field = field1 + field2
i have added below expression in props.conf
EVAL-sum_Acct_input= (field1*4)+(field2/1073741824)
problem is that i found event coverage of new field sum_acct_input = event coverage of field1 as field one not exist in all events ( it has empty values ) so how can i overcome this issue ? and also how to make this expression at index time not search time
You can utilize "coalesce" function to handle empty/null values of field 1 like below
props.conf
EVAL-sum_Acct_input = (coalesce(field1,0)*4+(field2/1073741824)
Per my knowledge, calculated fields can't be created during index time.
You can utilize "coalesce" function to handle empty/null values of field 1 like below
props.conf
EVAL-sum_Acct_input = (coalesce(field1,0)*4+(field2/1073741824)
Per my knowledge, calculated fields can't be created during index time.
coalesce(field1, field2)
is a nicer way of writing if(isnotnull(field1), field1, field2)
- basically, "take the first field from the list of arguments that isn't null".
thanks alot for your help i tested it and worked fine but may i know what excatly coalesce do ?