Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Eval Calculate fields with null values

$
0
0
Hello, I am attempting to run the search below which works when all values are present "One, Two, Three, Four" but when one of the values aren't present and is null, the search wont work as the eval command | eval Other=(One)+(Two)+(Three)+(Four) wont run if not all four values are present. Is there a way to fill the null with 0 so the eval will still work? Ive attempted usenull=true and fillnull but doesn't seem to work. index=myindex Survey_Answer5 | chart count over Survey_Question5 by Survey_Answer5 | rename 1 as "One" 2 as "Two" 3 as "Three" 4 as "Four" 5 as "WC" | eval Other=(One)+(Two)+(Three)+(Four) | eval Total=WC+Other | eval wcPercentage=round(WC/Total,4)*100 | eval otherPercentage=round(Other/Total,4)*100 | eval wcPercentage=wcPercentage + "%" | eval otherPercentage=otherPercentage + "%" | rename wcPercentage as "World Class" otherPercentage as "Other" Survey_Question5 as Question | table Question "World Class" Other

Viewing all articles
Browse latest Browse all 47296

Trending Articles