hi could someone please help me out here. been stuck with a problem. we have multiple existing queries in our environment. i am creating a sort of universal macro to work with the current queries.
the problem is, there are some fields which exists in some of the base queries but doesnt exist in another. how do i do a map in that macro with and if/isnull even with the missing fields.
Example
base search1 below:
| makeresults
| eval field1="abc"
| eval field2="def"
base search2 below:
| makeresults
| eval field1="abc"
| eval field2="def"
| eval field3="opq"
| eval field4="rst"
macro below:
| map [search index=test1...
| eval field1=if(isnull("$field1$"),"","$field1$")
| eval field2=if(isnull("$field2$"),"","$field2$")
| eval field3=if(isnull("$field3$"),"","$field3$")
| eval field4=if(isnull("$field4$"),"","$field4$")]
so the thing is, map will fail for base search1 but working on base search2. is there a way to fix this? there multiple fields in the base query.
thanks!
... View more