https://community.splunk.com/t5/Getting-Data-In/How-to-create-an-If-Statement-in-Props-conf/m-p/300554#M56819 <P>good question. I was asked on Friday when we were normalizing fields for ES. I will ask.</P> Mon, 02 Apr 2018 18:40:34 GMT pfabrizi 2018-04-02T18:40:34Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-an-If-Statement-in-Props-conf/m-p/300552#M56817 <P>I need to set a value based on another value. </P> <P>How would I do this:</P> <P>if severity = 1 severity=high</P> <P>One of my customers thought I can use a lookup table? I know I can do this in a search but not sure in a props.conf.</P> Mon, 02 Apr 2018 16:50:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-an-If-Statement-in-Props-conf/m-p/300552#M56817 pfabrizi 2018-04-02T16:50:37Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-an-If-Statement-in-Props-conf/m-p/300553#M56818 <P>Why not do this at search time?</P> Mon, 02 Apr 2018 18:03:16 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-an-If-Statement-in-Props-conf/m-p/300553#M56818 skoelpin 2018-04-02T18:03:16Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-an-If-Statement-in-Props-conf/m-p/300554#M56819 <P>good question. I was asked on Friday when we were normalizing fields for ES. I will ask.</P> Mon, 02 Apr 2018 18:40:34 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-an-If-Statement-in-Props-conf/m-p/300554#M56819 pfabrizi 2018-04-02T18:40:34Z