About chrismilleruk

chrismilleruk · ‎08-21-2013

I had a suspicion we'd end up with some sort of regex solution. I was actually wondering whether I could craft a regex transform to turn the space-delimited fields into comma-delimited fields but that's about as far as I got with that thought process. In any case, I think on balance you're probably right about searching vs dashboarding and it's just a short term inconvenience so I'm going to mark your other answer as correct. Thanks

chrismilleruk · ‎08-21-2013

Thanks sowings, EVAL looks pretty interesting. trim() doesn't work but the if()/null() statement has the effect I'm looking for. I need to do this for pretty much all fields extracted from the DELIMS transform and I have quite a few similar sourcetypes that need the same operation on multiple fields. There's probably a bit too much of a maintenance overhead with this approach but it's certainly a way to move forward.

chrismilleruk · ‎08-20-2013

I have some IIS logs with single line events which are space separated and use the "-" character to represent an null value. #Fields: field1 field2 field3 field4 etc 2013-08-16 13:24:13 192.168.17.187 - 200 and my transform stanza is as follows: [transform] DELIMS = " " FIELDS = field1 field2 field3 etc My problem is that when viewing results in the search app it reports that field4 appears in 100% of results when in actual fact it might be only a small percentage. This also adversely affects the query language (I have to use field4!="-" instead of field4 ). What I'm looking for is something like this: EMPTY_VALS = "-" KEEP_EMPTY_VALS = false Does anything like this exist? Is there a better way of doing it? Thanks in advance Edit #1: It should be noted that I need to do this for pretty much all fields across an increasing number of sourcetypes.

Posts	3
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎01-10-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How do I define the empty/default value for space ...

Re: How do I define the empty/default value for sp...

Re: How do I define the empty/default value for sp...

How do I define the empty/default value for space ...