Activity Feed
- Karma Re: How do I define the empty/default value for space delimited events? for sowings. 06-05-2020 12:46 AM
- Posted Re: How do I define the empty/default value for space delimited events? on All Apps and Add-ons. 08-21-2013 12:40 PM
- Posted Re: How do I define the empty/default value for space delimited events? on All Apps and Add-ons. 08-21-2013 02:24 AM
- Posted How do I define the empty/default value for space delimited events? on All Apps and Add-ons. 08-20-2013 07:04 AM
- Tagged How do I define the empty/default value for space delimited events? on All Apps and Add-ons. 08-20-2013 07:04 AM
- Tagged How do I define the empty/default value for space delimited events? on All Apps and Add-ons. 08-20-2013 07:04 AM
- Tagged How do I define the empty/default value for space delimited events? on All Apps and Add-ons. 08-20-2013 07:04 AM
- Tagged How do I define the empty/default value for space delimited events? on All Apps and Add-ons. 08-20-2013 07:04 AM
- Tagged How do I define the empty/default value for space delimited events? on All Apps and Add-ons. 08-20-2013 07:04 AM
- Tagged How do I define the empty/default value for space delimited events? on All Apps and Add-ons. 08-20-2013 07:04 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
08-21-2013
12:40 PM
I had a suspicion we'd end up with some sort of regex solution. I was actually wondering whether I could craft a regex transform to turn the space-delimited fields into comma-delimited fields but that's about as far as I got with that thought process.
In any case, I think on balance you're probably right about searching vs dashboarding and it's just a short term inconvenience so I'm going to mark your other answer as correct.
Thanks
... View more
08-21-2013
02:24 AM
Thanks sowings,
EVAL looks pretty interesting. trim() doesn't work but the if()/null() statement has the effect I'm looking for.
I need to do this for pretty much all fields extracted from the DELIMS transform and I have quite a few similar sourcetypes that need the same operation on multiple fields.
There's probably a bit too much of a maintenance overhead with this approach but it's certainly a way to move forward.
... View more
08-20-2013
07:04 AM
I have some IIS logs with single line events which are space separated and use the "-" character to represent an null value.
#Fields: field1 field2 field3 field4 etc
2013-08-16 13:24:13 192.168.17.187 - 200
and my transform stanza is as follows:
[transform]
DELIMS = " "
FIELDS = field1 field2 field3 etc
My problem is that when viewing results in the search app it reports that field4 appears in 100% of results when in actual fact it might be only a small percentage. This also adversely affects the query language (I have to use field4!="-" instead of field4 ).
What I'm looking for is something like this:
EMPTY_VALS = "-"
KEEP_EMPTY_VALS = false
Does anything like this exist? Is there a better way of doing it?
Thanks in advance
Edit #1:
It should be noted that I need to do this for pretty much all fields across an increasing number of sourcetypes.
... View more
