Splunk Search

using map and if/isnull but missing fields in base is causing failure

milidna13
New Member

hi could someone please help me out here. been stuck with a problem. we have multiple existing queries in our environment. i am creating a sort of universal macro to work with the current queries.

the problem is, there are some fields which exists in some of the base queries but doesnt exist in another. how do i do a map in that macro with and if/isnull even with the missing fields.

Example

base search1 below:

| makeresults
| eval field1="abc"
| eval field2="def"

base search2 below:

| makeresults
| eval field1="abc"
| eval field2="def"
| eval field3="opq"
| eval field4="rst"

macro below:

| map [search index=test1...
| eval field1=if(isnull("$field1$"),"","$field1$")
| eval field2=if(isnull("$field2$"),"","$field2$")
| eval field3=if(isnull("$field3$"),"","$field3$")
| eval field4=if(isnull("$field4$"),"","$field4$")]

so the thing is, map will fail for base search1 but working on base search2. is there a way to fix this? there multiple fields in the base query.

thanks!

Tags (2)
0 Karma

woodcock
Esteemed Legend

Yes, in the base search, end it with this command:

... | fields field1 field2 field3 field4 AND ALSO ANY OTHER FIELDS THAT YOU NEED TO KEEP ALL LISTED OUT HERE
0 Karma

vishaltaneja070
Motivator

@milidna13

You need to place a test of fields before map command always. If you are creating a macro then try to do it like this:

  eval field1 = if(isnull(field1),"", field1) | eval field2 = if(isnull(field2),"", field2) | eval field3 = if(isnull(field3),"", field3) | eval field4 = if(isnull(field4),"", field4)
     | map [| eval field1=if(isnull("$field1$"),"","$field1$")
     | eval field2=if(isnull("$field2$"),"","$field2$")
     | eval field3=if(isnull("$field3$"),"","$field3$")
     | eval field4=if(isnull("$field4$"),"","$field4$")  ]
0 Karma

jvishwak
Path Finder

Can you add a check for blank value as well, try this: | eval field1=if(isnull($field1$) OR field1 = "","",$field1$)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...