https://community.splunk.com/t5/Splunk-Search/How-to-evaluate-multiple-fields-and-replace-field-output-with/m-p/463375#M130630 <P>Here's one way to do that.</P> <PRE><CODE>... | eval field7 = if(field5="success", field7, "string of my choice") </CODE></PRE> Mon, 09 Dec 2019 16:46:58 GMT richgalloway 2019-12-09T16:46:58Z https://community.splunk.com/t5/Splunk-Search/How-to-evaluate-multiple-fields-and-replace-field-output-with/m-p/463374#M130629 <P>I have an issue where events are displaying incorrect information for a particular field in my search. </P> <P>Example: </P> <PRE><CODE>mySearch | table field 1, field 2, field 3, field 4, field 5, field 6, field 7 </CODE></PRE> <P>My problem is fields 4, 6, and 7 somewhat correspond with one another. </P> <P><STRONG>field 5 = errorCode<BR /> field 6 = errorMessage <BR /> field 7 = output string</STRONG></P> <P>If "field 5" = success ----------then "field 6" is null----------- and "field 7" shows the correct output string<BR /> HOWEVER<BR /> If "field 5" = an error code------- then "field 6" will show the error message-------BUT "field 7" shows the incorrect output string</P> <P>What I am trying to do is evaluate "field 5", and if "Field 5" equals anything other than "success" string then "field 7" will equal a new string of my choice. If "field 5" equals "success" than leave "field 7" alone. </P> Mon, 09 Dec 2019 16:22:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-evaluate-multiple-fields-and-replace-field-output-with/m-p/463374#M130629 garciajbg 2019-12-09T16:22:49Z https://community.splunk.com/t5/Splunk-Search/How-to-evaluate-multiple-fields-and-replace-field-output-with/m-p/463375#M130630 <P>Here's one way to do that.</P> <PRE><CODE>... | eval field7 = if(field5="success", field7, "string of my choice") </CODE></PRE> Mon, 09 Dec 2019 16:46:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-evaluate-multiple-fields-and-replace-field-output-with/m-p/463375#M130630 richgalloway 2019-12-09T16:46:58Z https://community.splunk.com/t5/Splunk-Search/How-to-evaluate-multiple-fields-and-replace-field-output-with/m-p/463376#M130631 <P>Richagalloway,</P> <P>I’ve tried this already but I can’t seem to get field 7 to show its default string. In the example given field 7 would show the name of field 7 rather than its original string if the search was run without the eval.</P> <P>For example, ran WITHOUT “eval” listed above.<BR /> Field 5 Field 6 Field 7<BR /> Success null success<BR /> Error ErrroMSG success</P> <P>Where field 5 shows the incorrect field 7 string</P> <P>For example WITH “eval” listed above<BR /> Field 5 Field 6 Field 7<BR /> Success null Field 7<BR /> Error ErrorMSG MyString</P> Mon, 09 Dec 2019 17:16:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-evaluate-multiple-fields-and-replace-field-output-with/m-p/463376#M130631 garciajbg 2019-12-09T17:16:57Z https://community.splunk.com/t5/Splunk-Search/How-to-evaluate-multiple-fields-and-replace-field-output-with/m-p/463377#M130632 <P>Please share your query.</P> Mon, 09 Dec 2019 18:11:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-evaluate-multiple-fields-and-replace-field-output-with/m-p/463377#M130632 richgalloway 2019-12-09T18:11:30Z https://community.splunk.com/t5/Splunk-Search/How-to-evaluate-multiple-fields-and-replace-field-output-with/m-p/463378#M130633 <P>richgalloway,</P> <P>So I was able to correct any issues by first renaming field 7 to something simple with no periods, spaces, etc. Once I did that and ran the search with the eval it worked as I wanted it to. Thanks!</P> Mon, 09 Dec 2019 19:09:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-evaluate-multiple-fields-and-replace-field-output-with/m-p/463378#M130633 garciajbg 2019-12-09T19:09:49Z