topic Run the condition on multiple fields of each events in Splunk Search https://community.splunk.com/t5/Splunk-Search/Run-the-condition-on-multiple-fields-of-each-events/m-p/473904#M133329 <P>I have set of events as below:</P> <P>EmployeeID Company<BR /> C123 ABC<BR /> C456 DEF <BR /> C789<BR /> 2598<BR /> 3648</P> <P>Here, all the EmployeeID starting with C are Contractors and some of them have Company values. Now I want to achieve 2 things<BR /> 1. I want to Populate "Unknown" where the EmployeeID starts with C but there is no Company value.<BR /> 2. And for all the other EmployeeID (not starting with C), I want to populate Fulltime.</P> <P>Thanks in advance!!</P> Wed, 08 Apr 2020 16:51:29 GMT khojas02 2020-04-08T16:51:29Z Run the condition on multiple fields of each events https://community.splunk.com/t5/Splunk-Search/Run-the-condition-on-multiple-fields-of-each-events/m-p/473904#M133329 <P>I have set of events as below:</P> <P>EmployeeID Company<BR /> C123 ABC<BR /> C456 DEF <BR /> C789<BR /> 2598<BR /> 3648</P> <P>Here, all the EmployeeID starting with C are Contractors and some of them have Company values. Now I want to achieve 2 things<BR /> 1. I want to Populate "Unknown" where the EmployeeID starts with C but there is no Company value.<BR /> 2. And for all the other EmployeeID (not starting with C), I want to populate Fulltime.</P> <P>Thanks in advance!!</P> Wed, 08 Apr 2020 16:51:29 GMT https://community.splunk.com/t5/Splunk-Search/Run-the-condition-on-multiple-fields-of-each-events/m-p/473904#M133329 khojas02 2020-04-08T16:51:29Z Re: Run the condition on multiple fields of each events https://community.splunk.com/t5/Splunk-Search/Run-the-condition-on-multiple-fields-of-each-events/m-p/473905#M133330 <P>This should help.</P> <PRE><CODE>... | eval Company = case(isnotnull(Company), Company, match(EmployeeID, "C.*"), "Unknown", 1==1, "Fulltime") </CODE></PRE> Wed, 08 Apr 2020 17:45:19 GMT https://community.splunk.com/t5/Splunk-Search/Run-the-condition-on-multiple-fields-of-each-events/m-p/473905#M133330 richgalloway 2020-04-08T17:45:19Z Re: Run the condition on multiple fields of each events https://community.splunk.com/t5/Splunk-Search/Run-the-condition-on-multiple-fields-of-each-events/m-p/473906#M133331 <P>Thanks a lot, it worked for me.</P> <P>I was trying to implement nested loop but it was giving me an error about malformed function or repeatable action. Thanking again for help!!</P> Wed, 08 Apr 2020 18:19:03 GMT https://community.splunk.com/t5/Splunk-Search/Run-the-condition-on-multiple-fields-of-each-events/m-p/473906#M133331 khojas02 2020-04-08T18:19:03Z