topic Re: case command in Splunk Search

case command

DataOrg — Tue, 20 Mar 2018 05:48:13 GMT

i want case command to match case where abc = hhh and after word should be same as present as it is
abc
abc
efg
ffh

Re: case command

niketn — Tue, 20 Mar 2018 06:08:39 GMT

@premranjithj, your question is not clear, please elaborate and add as much information as possible. What is the data you have (mock/dummy) along with field name? Also what is the query you have tried so far?

Re: case command

DataOrg — Tue, 20 Mar 2018 06:18:22 GMT

i have list of fields
1.abc
2.bbc
3.abc
4.ggh
5.usb

if i a field has value abc its should be replaced with 123. other fields can have the data as it is.

Re: case command

niketn — Tue, 20 Mar 2018 06:27:43 GMT

Is the field name abc or the value of the field abc? If it is second case what is the field name?

Re: case command

DataOrg — Tue, 20 Mar 2018 06:34:00 GMT

field name type and value is abc

Re: case command

niketn — Tue, 20 Mar 2018 08:03:33 GMT

[Updated Answer]
With exact match and run anywhere search query

Ok then you need the following to be added to your existing search

| makeresults
| eval type="abc,xyzabc,abcdef,xyzabcdef"
| makemv type delim="," 
| mvexpand type
| replace "abc" with "123" in type

Or else

| makeresults
| eval type="abc,xyzabc,abcdef,xyzabcdef"
| makemv type delim="," 
| mvexpand type
| eval type=replace(type,"^abc$","123")

Re: case command

DataOrg — Tue, 20 Mar 2018 10:24:11 GMT

| eval type=replace(type,"abc","123")

this condition replaces all the pattern with abc. i want only with exact match "abc".

for example if fields value with "abcefg" it matches and getting replaced with 123

Re: case command

niketn — Tue, 20 Mar 2018 13:29:09 GMT

So try this

| eval type=replace(type,"^abc$","123")

You can also try as per previous comment.

| replace "abc" with "123" in type