Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Help with replacing values

$
0
0
Hi, I have my output I was looking for, but was wondering if there was a cleaner way to do it. Basically I have a field like such f1||f2||f3||f4. f2 and f3 can be null in some cases. If they are null I wanted to replace them with my own string. right now i have this as my query. rex field=transaction_type "(?.)||(?.)||(?.)||(?.)" | eval FromAcct = if(FromAcct="null", "Non" ,FromAcct) | eval ToAcct = if(ToAcct="null", "Non" ,ToAcct) | stats count by TransferType, FromAcct, ToAcct, When | sort count desc Now I dont like that i have two evals cases where I use if. I wanted to use eval case but wasn't able to get it to work because of how I parse my field. Thanks for the help! Thanks!

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>