Splunk Search

replace with a where clause on a null field

mjones414
Contributor

I seem to be having a syntactical error that I can't resolve in splunk 6.1 when I have about 3 fields that may have user defined values all classifying the same thing. It's essentially luck of the draw which field gets used based on how the user entered it from my perspective, and that mechanism has no immediate future of changing. So 90% of the time I could have 2 of the three fields null, 5% of the time it'll be in one of the thre fields and 5% of the time it'll be in 2 of the three fields. I know which field I want to consider my "true" field if there is a value, but if there is not I want it replaced with one of the other fields that's not null. Additionally, I'm trying to tokenize it from a single multiselect box and that box also needs to distinctly list one entry per result.

Any ideas on how I should approach the where syntax here? I think once I do this, I could pretty easily tokenize it.

Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
... | eval field=coalesce(field1, field2, field3) | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

mjones414
Contributor

Wow that is actually not the behavior I was expecting from coalesce which is why I didn't think to try it. I was imagining something more to the dictionary definition of the word which is to merge but behaviorally it appears to be taking the first field in my list of fields that isn't Null. So as long as my first field is the "true" field should it be present, this does exactly what I want!

Thank you!!

0 Karma

mjones414
Contributor

Wow that is actually not the behavior I was expecting from coalesce which is why I didn't think to try it. I was imagining something more to the dictionary definition of the word which is to merge but behaviorally it appears to be taking the first field in my list of fields that isn't Null. So as long as my first field is the "true" field should it be present, this does exactly what I want!

Thank you!!

0 Karma

richgalloway
SplunkTrust
SplunkTrust
... | eval field=coalesce(field1, field2, field3) | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

mjones414
Contributor

Wow that is actually not the behavior I was expecting from coalesce which is why I didn't think to try it. I was imagining something more to the dictionary definition of the word which is to merge but behaviorally it appears to be taking the first field in my list of fields that isn't Null. So as long as my first field is the "true" field should it be present, this does exactly what I want!

Thank you!!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...