Hi,
I am using the following script in Splunk query. Here i am trying having multiple values in field AdditionalData
and splitting them to extract the fields and writing to separate fields. Now if there is any blank value, in any of these extract fields, i want to have the default value appear as Not Available.
Thanks in advance
| eval "AddtionalData"=if(isnotnull('cip:AuditMessage.ExtraData'),'cip:AuditMessage.ExtraData',"Not Available")
| rex field=AddtionalData "Legal employer name:(?<LegalEmployerName>[^,]+)"
| rex field=AddtionalData "Legal entity:(?<LegalEntity>[^,]+)"
| rex field=AddtionalData "Country:(?<Country>[^,]+)"
| rex field=AddtionalData "Business unit:(?<BusinessUnit>[^,]+)"
Hi @manojchacko78,
yu could try fill null:
<your_search>
| eval "AddtionalData"=if(isnotnull('cip:AuditMessage.ExtraData'),'cip:AuditMessage.ExtraData',"Not Available")
| rex field=AddtionalData "Legal employer name:(?<LegalEmployerName>[^,]*)"
| rex field=AddtionalData "Legal entity:(?<LegalEntity>[^,]*)"
| rex field=AddtionalData "Country:(?<Country>[^,]*)"
| rex field=AddtionalData "Business unit:(?<BusinessUnit>[^,]*)"
| fillnull value="Not Available" LegalEmployerName
| fillnull value="Not Available" LegalEntity
| fillnull value="Not Available" Country
| fillnull value="Not Available" BusinessUnit
remember in your regexes, to use "*" instead "+" when you could have no values.
Ciao.
Giuseppe
Thanks a lot @gcusello. You are an angel 🙂
Hi @manojchacko78,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉
Hi @manojchacko78,
yu could try fill null:
<your_search>
| eval "AddtionalData"=if(isnotnull('cip:AuditMessage.ExtraData'),'cip:AuditMessage.ExtraData',"Not Available")
| rex field=AddtionalData "Legal employer name:(?<LegalEmployerName>[^,]*)"
| rex field=AddtionalData "Legal entity:(?<LegalEntity>[^,]*)"
| rex field=AddtionalData "Country:(?<Country>[^,]*)"
| rex field=AddtionalData "Business unit:(?<BusinessUnit>[^,]*)"
| fillnull value="Not Available" LegalEmployerName
| fillnull value="Not Available" LegalEntity
| fillnull value="Not Available" Country
| fillnull value="Not Available" BusinessUnit
remember in your regexes, to use "*" instead "+" when you could have no values.
Ciao.
Giuseppe