Splunk Search

How to create a conditional eval to fill a new field depending on other fields?

lyds
Explorer

Hello,
I want to create a new field that will take the value of other fields depending of which one is filled.

For example, I have 5 fields but only one can be filled at a time. The other fields don't have any value.

Field1:
Field2:
Field3:
Field4: Ok
Field5:

How can I write the eval to check if a field1 is null, take the value of the following field2, if it is also null, take the value of field3 until it reaches the not null field?

Thank you.

0 Karma
1 Solution

nawazns5038
Builder

Try coalesce command

eval new_field=coalesce(Field1,Field2,....)

https://www.splunk.com/blog/2014/03/21/search-command-coalesce.html

View solution in original post

0 Karma

nawazns5038
Builder

Try coalesce command

eval new_field=coalesce(Field1,Field2,....)

https://www.splunk.com/blog/2014/03/21/search-command-coalesce.html

0 Karma

lyds
Explorer

I've used coalesce command, and I get what I wanted to display!

Thanks you all for the help!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@lyds, If your problem is resolved, please accept an answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this. The new field name will be called NewField and assumes your field name is field

| eval NewField=if(isnull(Field),"null",'Field')
0 Karma

inventsekar
Ultra Champion

Hi @skoelpin ... i think you missed the 5 fields part of the question..
--- I have 5 fields but only one can be filled at a time. The other fields don't have any value.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

It's the same exact logic with a case statement...

0 Karma

RHASQaL
Path Finder

I think I'd use the coalesce eval function. It's description is 'This function takes an arbitrary number of arguments and returns the first value that is not NULL.'

0 Karma

inventsekar
Ultra Champion

with coalesce, try this one..
search Field="*" | eval NewField=coalesce(Field1, Field2, Field3, Field4, Field5) | eval result=if(NewField="Ok", "all good", "some fields are not null")

0 Karma

inventsekar
Ultra Champion

//// I have 5 fields but only one can be filled at a time. The other fields don't have any value ////
In your search use the fillnull command and assign a value to that field when it is null, then count that value for the field.

search Field="*" | fillnull value=NULL | stats count by Field | where count=1

Updated - with coalesce, try this one..

search Field="*" | eval NewField=coalesce(Field1, Field2, Field3, Field4, Field5) | eval result=if(NewField="Ok", "all good", "some fields are not null")

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...