Can I fill null results of a field with results from another field?

[anthony_copus]

Hi,

I'm currently looking at partially complete logs, where some contain an article_id, but some don't. Is it possible to take a value from a different field (video_id) to populate that field when is it null? Currently I'm trying to use this query:

index="video" | fillnull value=video_id article_id

Obviously it's intended to put the value from the video_id into article_id where article_id is null, but it only puts the string "video_id" instead. Is there a way around this?

Anthony

[somesoni2 · Accepted solution]

Use Eval-Coalesce instead

index="video" | eval article_id=coalesce(article_id,video_id) |...

This will take the first non-null value from article_id,video_id and populate to article_id.