Splunk Search

replace with a where clause on a null field

mjones414
Contributor

I seem to be having a syntactical error that I can't resolve in splunk 6.1 when I have about 3 fields that may have user defined values all classifying the same thing. It's essentially luck of the draw which field gets used based on how the user entered it from my perspective, and that mechanism has no immediate future of changing. So 90% of the time I could have 2 of the three fields null, 5% of the time it'll be in one of the thre fields and 5% of the time it'll be in 2 of the three fields. I know which field I want to consider my "true" field if there is a value, but if there is not I want it replaced with one of the other fields that's not null. Additionally, I'm trying to tokenize it from a single multiselect box and that box also needs to distinctly list one entry per result.

Any ideas on how I should approach the where syntax here? I think once I do this, I could pretty easily tokenize it.

Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
... | eval field=coalesce(field1, field2, field3) | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

mjones414
Contributor

Wow that is actually not the behavior I was expecting from coalesce which is why I didn't think to try it. I was imagining something more to the dictionary definition of the word which is to merge but behaviorally it appears to be taking the first field in my list of fields that isn't Null. So as long as my first field is the "true" field should it be present, this does exactly what I want!

Thank you!!

0 Karma

mjones414
Contributor

Wow that is actually not the behavior I was expecting from coalesce which is why I didn't think to try it. I was imagining something more to the dictionary definition of the word which is to merge but behaviorally it appears to be taking the first field in my list of fields that isn't Null. So as long as my first field is the "true" field should it be present, this does exactly what I want!

Thank you!!

0 Karma

richgalloway
SplunkTrust
SplunkTrust
... | eval field=coalesce(field1, field2, field3) | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

mjones414
Contributor

Wow that is actually not the behavior I was expecting from coalesce which is why I didn't think to try it. I was imagining something more to the dictionary definition of the word which is to merge but behaviorally it appears to be taking the first field in my list of fields that isn't Null. So as long as my first field is the "true" field should it be present, this does exactly what I want!

Thank you!!

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...