https://community.splunk.com/t5/Splunk-Search/How-to-create-a-field-with-selected-values-of-the-same-field/m-p/410028#M118267 <P>If this answerd your question @umsundar2015, please mark it as closed/upvote.</P> Mon, 21 Jan 2019 12:54:19 GMT vik_splunk 2019-01-21T12:54:19Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-field-with-selected-values-of-the-same-field/m-p/410026#M118265 <P>Hi ,</P> <P>I have OS field which has many rows .In that i need to filter only the below values and create a field ,<BR /> Windows Server 2012 R2 Standard<BR /> Windows 7<BR /> Windows Server 2012<BR /> Windows 7 Enterprise<BR /> Windows 10<BR /> Microsoft Windows Server 2008 R2 Standard<BR /> Microsoft Windows Server 2008 R2 Enterprise<BR /> Microsoft Windows 2008 Server Standard<BR /> Windows 8<BR /> Windows 10 Enterprise</P> <P>When i use match function like ,<BR /> eval OS=mvfilter(match(OS,"Windows Server 2012 R2 Standard") OR match(OS,"Windows Server 2012") OR match(OS,"Windows 7")) |stats count by OS</P> <P>I am getting other values "Windows 7 embedded " also which i dont need in the list of values.</P> <P>Please help to filter the exact values which i needed above.</P> <P>Thanks .</P> Fri, 23 Nov 2018 06:39:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-field-with-selected-values-of-the-same-field/m-p/410026#M118265 umsundar2015 2018-11-23T06:39:14Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-field-with-selected-values-of-the-same-field/m-p/410027#M118266 <P>Hi @umsundar2015 </P> <P>A few different ways to do this.</P> <P>1)Using replace : If your "other" options are limited, you could do something like below</P> <P>|replace "Windows 7 embedded" WITH "Windows 7" IN OS (You can use wild characters and multiple values to replace in one single command.</P> <P>Reference here : <A href="http://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/Replace">http://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/Replace</A></P> <P>2)Using eval case : Spinning up an example without sample data is going to be difficult but a sample query will look like</P> <P>|eval OS=case(match(OS,"Windows 7 embedded"),"Windows 7,..... series of such match functions(or can use simple OS==),finally a default match)</P> <P>Reference here: <A href="http://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/ConditionalFunctions">http://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/ConditionalFunctions</A></P> <P>Hope that helps!</P> Fri, 23 Nov 2018 13:05:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-field-with-selected-values-of-the-same-field/m-p/410027#M118266 vik_splunk 2018-11-23T13:05:11Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-field-with-selected-values-of-the-same-field/m-p/410028#M118267 <P>If this answerd your question @umsundar2015, please mark it as closed/upvote.</P> Mon, 21 Jan 2019 12:54:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-field-with-selected-values-of-the-same-field/m-p/410028#M118267 vik_splunk 2019-01-21T12:54:19Z