Splunk Search

skip step in foreach

spisiakmi
Contributor

Hi, any help, please?

Here is the code

| makeresults
| eval tmp_1=1
| eval tmp_2=""
| eval tmp_3=3
| eval tmp=""
| foreach tmp_*
[| eval tmp = tmp ."|".if(isnotnull(<<FIELD>>),<<FIELD>>,"")]
| eval tmp=substr(tmp, 2)
| table tmp

Output is: tmp=1||3

I would like to have output tmp="1|3", it means how to skip the step in foreach, if the <<FIELD>> is null?

Labels (1)
0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Hi @spisiakmi 

I dont think your isnotnull is matchnig as you expect on "", try this:

| makeresults
| eval tmp_1=1
| eval tmp_2=""
| eval tmp_3=3
| eval tmp=""
| foreach tmp_*
[| eval tmp = tmp.if(<<FIELD>>!="",<<FIELD>>."|","")]
| eval tmp=trim(tmp,"|")
| table tmp

 

View solution in original post

livehybrid
SplunkTrust
SplunkTrust

Hi @spisiakmi 

I dont think your isnotnull is matchnig as you expect on "", try this:

| makeresults
| eval tmp_1=1
| eval tmp_2=""
| eval tmp_3=3
| eval tmp=""
| foreach tmp_*
[| eval tmp = tmp.if(<<FIELD>>!="",<<FIELD>>."|","")]
| eval tmp=trim(tmp,"|")
| table tmp

 

spisiakmi
Contributor

livehybrid thank you very much, simple, easy, fast. Very good.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @spisiakmi ,

please try this:

| makeresults
| eval tmp_1=1
| eval tmp_2=""
| eval tmp_3=3
| eval tmp=""
| foreach tmp_*
[| eval tmp = tmp ."|".if(isnotnull(<<FIELD>>),<<FIELD>>,"")]
| eval tmp=substr(tmp, 2)
| rex field=tmp mode=sed "s/\|+/|/g"
| table tmp

Ciao.

Giuseppe

 

spisiakmi
Contributor

Hey gcusello, thank you very much.

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...