replace with a where clause on a null field

[mjones414]

I seem to be having a syntactical error that I can't resolve in splunk 6.1 when I have about 3 fields that may have user defined values all classifying the same thing. It's essentially luck of the draw which field gets used based on how the user entered it from my perspective, and that mechanism has no immediate future of changing. So 90% of the time I could have 2 of the three fields null, 5% of the time it'll be in one of the thre fields and 5% of the time it'll be in 2 of the three fields. I know which field I want to consider my "true" field if there is a value, but if there is not I want it replaced with one of the other fields that's not null. Additionally, I'm trying to tokenize it from a single multiselect box and that box also needs to distinctly list one entry per result.

Any ideas on how I should approach the where syntax here? I think once I do this, I could pretty easily tokenize it.

[mjones414]

Wow that is actually not the behavior I was expecting from coalesce which is why I didn't think to try it. I was imagining something more to the dictionary definition of the word which is to merge but behaviorally it appears to be taking the first field in my list of fields that isn't Null. So as long as my first field is the "true" field should it be present, this does exactly what I want!

Thank you!!

[mjones414]

Wow that is actually not the behavior I was expecting from coalesce which is why I didn't think to try it. I was imagining something more to the dictionary definition of the word which is to merge but behaviorally it appears to be taking the first field in my list of fields that isn't Null. So as long as my first field is the "true" field should it be present, this does exactly what I want!

Thank you!!

[richgalloway · Accepted solution]

... | eval field=coalesce(field1, field2, field3) | ...

[mjones414]

Wow that is actually not the behavior I was expecting from coalesce which is why I didn't think to try it. I was imagining something more to the dictionary definition of the word which is to merge but behaviorally it appears to be taking the first field in my list of fields that isn't Null. So as long as my first field is the "true" field should it be present, this does exactly what I want!

Thank you!!