using map and if/isnull but missing fields in base is causing failure

[milidna13]

hi could someone please help me out here. been stuck with a problem. we have multiple existing queries in our environment. i am creating a sort of universal macro to work with the current queries.

the problem is, there are some fields which exists in some of the base queries but doesnt exist in another. how do i do a map in that macro with and if/isnull even with the missing fields.

Example

base search1 below:

| makeresults
| eval field1="abc"
| eval field2="def"

base search2 below:

| makeresults
| eval field1="abc"
| eval field2="def"
| eval field3="opq"
| eval field4="rst"

macro below:

| map [search index=test1...
| eval field1=if(isnull("$field1$"),"","$field1$")
| eval field2=if(isnull("$field2$"),"","$field2$")
| eval field3=if(isnull("$field3$"),"","$field3$")
| eval field4=if(isnull("$field4$"),"","$field4$")]

so the thing is, map will fail for base search1 but working on base search2. is there a way to fix this? there multiple fields in the base query.

thanks!

[woodcock]

Yes, in the base search, end it with this command:

... | fields field1 field2 field3 field4 AND ALSO ANY OTHER FIELDS THAT YOU NEED TO KEEP ALL LISTED OUT HERE

[vishaltaneja070]

@milidna13

You need to place a test of fields before map command always. If you are creating a macro then try to do it like this:

  eval field1 = if(isnull(field1),"", field1) | eval field2 = if(isnull(field2),"", field2) | eval field3 = if(isnull(field3),"", field3) | eval field4 = if(isnull(field4),"", field4)
     | map [| eval field1=if(isnull("$field1$"),"","$field1$")
     | eval field2=if(isnull("$field2$"),"","$field2$")
     | eval field3=if(isnull("$field3$"),"","$field3$")
     | eval field4=if(isnull("$field4$"),"","$field4$")  ]

[jvishwak]

Can you add a check for blank value as well, try this: | eval field1=if(isnull($field1$) OR field1 = "","",$field1$)