https://community.splunk.com/t5/Reporting/How-to-build-a-report-using-if-condition/m-p/97089#M2232 <P>Or just: <CODE>source=mylog field2=1 | ...</CODE></P> Wed, 01 Dec 2010 12:56:56 GMT gkanapathy 2010-12-01T12:56:56Z https://community.splunk.com/t5/Reporting/How-to-build-a-report-using-if-condition/m-p/97087#M2230 <P>Now I have two fields(named field 1 and field 2) for one log file. Field 2 just has two kinds of value "1" and "2". I want to build a chart to show field 1's value when field 2's value equals "1". How can I do that? Thanks for any help!</P> Wed, 01 Dec 2010 11:49:36 GMT https://community.splunk.com/t5/Reporting/How-to-build-a-report-using-if-condition/m-p/97087#M2230 zeaxodarap 2010-12-01T11:49:36Z https://community.splunk.com/t5/Reporting/How-to-build-a-report-using-if-condition/m-p/97088#M2231 <P>One way...</P> <PRE><CODE>... | where field2=1 | table field1 </CODE></PRE> Wed, 01 Dec 2010 12:28:08 GMT https://community.splunk.com/t5/Reporting/How-to-build-a-report-using-if-condition/m-p/97088#M2231 bwooden 2010-12-01T12:28:08Z https://community.splunk.com/t5/Reporting/How-to-build-a-report-using-if-condition/m-p/97089#M2232 <P>Or just: <CODE>source=mylog field2=1 | ...</CODE></P> Wed, 01 Dec 2010 12:56:56 GMT https://community.splunk.com/t5/Reporting/How-to-build-a-report-using-if-condition/m-p/97089#M2232 gkanapathy 2010-12-01T12:56:56Z https://community.splunk.com/t5/Reporting/How-to-build-a-report-using-if-condition/m-p/97090#M2233 <P>eh...quite easy...I'm not familiar with Splunk search language...Thank u</P> Wed, 01 Dec 2010 14:57:27 GMT https://community.splunk.com/t5/Reporting/How-to-build-a-report-using-if-condition/m-p/97090#M2233 zeaxodarap 2010-12-01T14:57:27Z