All Apps and Add-ons

SA-cim_validator: Why is this eval expression producing message "found 1 unexpected values (?)"

bagarwal
Path Finder

Hello,

Can anyone explain to me what the below syntax signifies? While validating data audit logs to CIM validator, one of the fields is saying 1 unexpected value:
alt text

When I checked in Settings->DataModels->Authetication Object; I found the eval expresssion for src as below:

if(isnull(src) OR src="","unknown",src)

What does the above syntax represent, and how can I eliminate the error found 1 unexpected values(?) to expected values.

0 Karma

woodcock
Esteemed Legend

It is a silly way of ensuring that src is non-null (has a value). Try this instead:

coalesce(src, "unknown")
0 Karma

bagarwal
Path Finder

Thanks!!
I have tried with the below combination :

if(isnull(src) OR src=='?',"unknown",src)

The result is coming correct but again replaces other values also as unknown. Is it something it is considering '?' as regex value and if yes how we can nullify it and consider as the value of src.

0 Karma

bagarwal
Path Finder

Thanks!! However , I want to replace value of src = ? to unknown and for that I wrote the expression as like this:

if(isnull(src) OR src="?","unknown",src) ; however it is taking the value but it replaces all other src values to unknown too. e.g if src = 172.*.*.* any IP address; it also replaces to unknown.

I tried with other way also ; but same result I am getting.

if(isnull(src) OR src=="\?","unknown",src)
if(isnull(src) OR src=="?","unknown",src)

Basically, I want only value "?" should be replaced with unknown.

If anyone can tell, it would be really help. Thanks in advance.

0 Karma

woodcock
Esteemed Legend

Try this:

if((isnull(src) OR like(src,"?")), "unknown", src)
0 Karma

woodcock
Esteemed Legend

This one should definitely do it.

0 Karma

bagarwal
Path Finder

Thank You so much!! However , it is also not giving the desired result.

Is it something that the null value can only be replaced in raw data ? I am not sure though.

0 Karma

MuS
SplunkTrust
SplunkTrust

Have you tried

if(isnull(src) OR src=='?',"unknown",src)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...