Hi,
I'm currently looking at partially complete logs, where some contain an article_id, but some don't. Is it possible to take a value from a different field (video_id) to populate that field when is it null? Currently I'm trying to use this query:
index="video" | fillnull value=video_id article_id
Obviously it's intended to put the value from the video_id into article_id where article_id is null, but it only puts the string "video_id" instead. Is there a way around this?
Anthony
Use Eval-Coalesce instead
index="video" | eval article_id=coalesce(article_id,video_id) |...
This will take the first non-null value from article_id,video_id and populate to article_id.
Use Eval-Coalesce instead
index="video" | eval article_id=coalesce(article_id,video_id) |...
This will take the first non-null value from article_id,video_id and populate to article_id.