Splunk Search

Field extractions with default value

ltruesda
Explorer

Can a field extraction be devised so that it has a default value when the regex is not matched?

I have defined an extracted field based on a regex which matches a specific pattern in an event. The resulting field will contain the matched data if it was present and the field will not exist for an event where the pattern was not matched.

All that is good.

However, for the cases where the pattern did not match, I would rather the field exist and contain a hyphen ("-").

Within the confines of a field extraction, is there a way to do this? I know I could use fillnull to add the hyphens later, but I'd prefer a more elegant solution.

In no solution exists, I can live with it, but if I can have this, it would streamline my searching.

Thanks!

Tags (3)
1 Solution

LukeMurphey
Champion

You could use calculated fields if you want to avoid using searches to populate the value.

In this snippet from props.conf, bytes_out will always be populated to 0 if it was null:

[somesourcetype]
EVAL-bytes_out = if(isnull(bytes_out),0,bytes_out)

The normal eval functions should work. Note that calculated fields was included starting with Splunk 5.0 so it won't work on 4.X or earlier.

View solution in original post

LukeMurphey
Champion

You could use calculated fields if you want to avoid using searches to populate the value.

In this snippet from props.conf, bytes_out will always be populated to 0 if it was null:

[somesourcetype]
EVAL-bytes_out = if(isnull(bytes_out),0,bytes_out)

The normal eval functions should work. Note that calculated fields was included starting with Splunk 5.0 so it won't work on 4.X or earlier.

ltruesda
Explorer

Thanks, just what the doctor ordered! 🙂

0 Karma

aholzer
Motivator

You can simply use the command fillnull at search time to get what you want.

http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/fillnull

Like so:

| fillnull value="-"

Where needs to be the field that you want to add hyphens instead of not having the field.

Hope this helps

aholzer
Motivator

Guess I should read peoples questions more carefully 🙂

Take a look at Luke's answer. Looks promising.

0 Karma

ltruesda
Explorer

As mentioned in my question I knew about this possibility. But I am hoping to have this populated at extraction time and simplify my searches.

0 Karma

aholzer
Motivator

Fair enough @Ayn 🙂

0 Karma

Ayn
Legend

I converted your comment into an answer - if it's an answer please put it in as one 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...