output from both nix and win matchup issue

[hartfoml]

I am looking for logon errors from both windows and nix systems and trying to get as much data to match up as proposal

Here is my win search:

index=main or index=os action=failure 'logins' | top host, user, EventCodeDescription limit="10000" | sort -count | fields count, host, user, EventCodeDescription, EventCode, percent

this works fine because win has all the fields in the output. nix does not. the nix events are identified by the 'logins' macro but they do not have the right fileds so they do not show in the results table.

I have tried this to add the field "EventCodeDescription" when nul:

index=main OR index=os action=failurelogins| eval EventCodeDescription=if(EventCodeDescription==" ", "nix failed logon", EventCodeDescription) | top host, user, EventCodeDescription limit="10000" | sort -count | fields count, host, user, EventCodeDescription, EventCode, percent

But the field is not added.

How can I add a field and a VALUE to the nix events where there is no field so that they show up with the win events?

[lukejadamec · Accepted solution]

fillnull value=NULL

[hartfoml]

Thanks that really helps. that was the answer

[lukejadamec]

It does not have to be null.

|fillnull value="failed logon" EventCodeDescription |
You don't need the if statement.

[hartfoml]

wont this set the win value for "EventCodeDescription" to null?

If i do this

|fillnull value=null EventCodeDescription | eval EventCodeDescription=if(EventCodeDescription=null,"failed logon",)

I still get "EventCodeDescription=null"