Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

how to fill NULL in dashboard when element is not occurred in XML

$
0
0
Hello, I have following XML loaded into filed 'data'. Strin2String5String7 I am able to extract the 'stepEventName', 'nextEventNam' element values using below spath: spath input=data output=StepEvent path=SummaryEvent.StepEvent.stepEventName | spath input=data output=NextEvent path=SummaryEvent.StepEvent.nextEventName | eval x=mvzip(NextEvent,StepEvent) | mvexpand x| eval x=split(x,",") | eval NextEvent=mvindex(x,0) | eval StepEvent=mvindex(x,1) | fillnull value="NULL" |table NextEvent,StepEvent But when i try to display event list i do get below since nextEventName occured once in 'Step' ------------------------------------- _time NextEvent StepEvent ------------------------------------- timestamp String5 String2 But the below is what i want to display. ------------------------------------- _time NextEvent StepEvent ------------------------------------- timestamp String5 String2 timestamp NULL String5 How to get the NULL when nextEventName is not occured in 'Step' Thanks in Advance

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>