I have a field that I want to report on, but in some of my events, that field is missing (null) and so I'd like to use another field value instead. Is there a way to perform an in-line "If-Then-Else" type logic within the search itself?
I'll use " | eval coalesce... "
I know the question is old, and the question was about if then else, but OP was really asking for coalesce and this is the right answer here. | eval field=coalesce(field1,field2,"misc")
will return assign field to the first non-null result in a list. e.g. field1 if its not null, if it is null coalesce will return field2, if that is null as well, the field will just be the string "misc".
Also, see this page in the Splunk docs for more details regaring the "eval" command:
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eval
Also, see this page regarding the functions that can be used with the "eval" command:
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions
... | eval field=if(isnull(field),elsefield,field) | ...
or use directly within a stats
... | stats sum(eval(if(isnull(field),elsefield,field))) as mysum ...