Splunk Search

Can you help me with the following query using the coalesce command?

pfabrizi
Path Finder

I am trying this transform. Sometime the subjectuser is set and sometimes the targetuser. All works fine, but the data coming into the subject user is a dash, and that is what user is getting set to instead of the value that is correct in target user.

Is there any way around this? So, if a subject user is less than 2 characters for example?

Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

You can use this:

EVAL-subjectuser=if(subjectuser=="-", targetuser, subjectuser)

Or in search SPL, this:

| eval subjectuser=if(subjectuser=="-", targetuser, subjectuser)

View solution in original post

0 Karma

woodcock
Esteemed Legend

You can use this:

EVAL-subjectuser=if(subjectuser=="-", targetuser, subjectuser)

Or in search SPL, this:

| eval subjectuser=if(subjectuser=="-", targetuser, subjectuser)
0 Karma

Vijeta
Influencer

you can add | replace "-" with "" in subjectuser before coalesce

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...