https://community.splunk.com/t5/Splunk-Dev/How-do-I-create-an-eval-statement-to-combine-similar-fields/m-p/455337#M8288 <P>Hi,</P> <P>If I have data that looks like this</P> <PRE><CODE>abc abc456 xyz xyz456 </CODE></PRE> <P>How could I create an eval statement that says</P> <PRE><CODE>if field1=abc or if field1=field1+456 then field1=field1? </CODE></PRE> <P>Meaning, combine "abc" and "abc456", and combine "xyz" and "xyz456" together.</P> Wed, 12 Sep 2018 21:13:59 GMT dbcase 2018-09-12T21:13:59Z https://community.splunk.com/t5/Splunk-Dev/How-do-I-create-an-eval-statement-to-combine-similar-fields/m-p/455337#M8288 <P>Hi,</P> <P>If I have data that looks like this</P> <PRE><CODE>abc abc456 xyz xyz456 </CODE></PRE> <P>How could I create an eval statement that says</P> <PRE><CODE>if field1=abc or if field1=field1+456 then field1=field1? </CODE></PRE> <P>Meaning, combine "abc" and "abc456", and combine "xyz" and "xyz456" together.</P> Wed, 12 Sep 2018 21:13:59 GMT https://community.splunk.com/t5/Splunk-Dev/How-do-I-create-an-eval-statement-to-combine-similar-fields/m-p/455337#M8288 dbcase 2018-09-12T21:13:59Z https://community.splunk.com/t5/Splunk-Dev/How-do-I-create-an-eval-statement-to-combine-similar-fields/m-p/455338#M8289 <P>A bit more info as I think I gave a poor example</P> <P>abc can be 3 positions or it could be abcdef (more than 3 positions), however, 456 is always consistent</P> Wed, 12 Sep 2018 22:12:55 GMT https://community.splunk.com/t5/Splunk-Dev/How-do-I-create-an-eval-statement-to-combine-similar-fields/m-p/455338#M8289 dbcase 2018-09-12T22:12:55Z https://community.splunk.com/t5/Splunk-Dev/How-do-I-create-an-eval-statement-to-combine-similar-fields/m-p/455339#M8290 <P>Solved it, used the like function</P> Wed, 12 Sep 2018 22:44:37 GMT https://community.splunk.com/t5/Splunk-Dev/How-do-I-create-an-eval-statement-to-combine-similar-fields/m-p/455339#M8290 dbcase 2018-09-12T22:44:37Z