I have a log file which gives me a list of physicians and insurers.
sourcetype="patientlog" id=1 physician=Kelly,Jack insurer=BCBS
sourcetype="patientlog" id=2 insurer=Medicare
sourcetype="patientlog" id=3 physician=James,Francis
I want to create a table such that for every patient id I can list the physician and insurer.
id1 physician insurer
1 Kelly, Jack BCBS
2 NONE Medicare
3 James, Francis NONE
This is a little tricky becaues the way the log is written I cant really write out a "NONE" if I do something like
sourcetype="patientlog" physician=* insurer=* | stats physician, insurer by id
Anybody know a smart way of doing this ? I cant change the log file but I need to display empty values as "NONE" somehow
You could use the fillnull command
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fillnull
You need to specify the field names after the value="NA" ... ie: sourcetype="patientlog" | fillnull value="NA" physician | table physician, insurer
That did not work out 😞
sourcetype="patientlog" | fillnull value="NA" | table physician, insurer ?