Splunk Search

to check the attribute exist and assign the value

Jasmine
Path Finder

If attr.error exist then Error will be attr.error. If attr.error not exist and attr.error.errmsg exist then Error would be attr.error.errmsg.  i have tried the below code. only one case works other case fails. please advise

eval Error=case(NOT attr.error =="*", 'attr.error',NOT attr.error.errmsg =="*", 'attr.error.errmsg')

 

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

What @richgalloway said, but whenever you reference a JSON field containing dots in the right hand side of an eval you MUST wrap the field name in single quotes, i.e. the first suggestion should be

eval Error=case(isnotnull('attr.error'), 'attr.error', 
                isnotnull('attr.error.errmsg'), 'attr.error.errmsg')

but for your solution the coalesce() option would make sense - note there the use of single quotes - always for the right hand side of the eval. 

This applies not just to JSON field names, but any field name that contains non simple characters or field names that start with numbers.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Check for the existence of a field with the isnotnull() function.

eval Error=case(isnotnull(attr.error), 'attr.error', isnotnull(attr.error.errmsg), 'attr.error.errmsg')

or use the coalesce() function, which does the tests for you and selects the first listed field that is not null.

eval Error=coalesce('attr.error','attr.error.errmsg')

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...