topic Re: Setting field value based on another field in Splunk Search

Setting field value based on another field

tsheets13 — Wed, 24 Jun 2020 18:40:45 GMT

I have a value in my events called type, which is a single digit integer (1, 2, 3, etc.)

I would like to create a new string field in my search based on that value.

So, something like this pseudocode...

if type = 1 then desc = "pre"
if type = 2 then desc = "current"
if type = 3 then desc = "post"

I realize the splunk doesn't do if/then statements but I thought that was the easiest way to explain.

Thanks

gcusello — Thu, 05 Mar 2020 16:16:44 GMT

Hi @tsheets13,
you have to use eval command with case option:

| eval desc=case(type="1","pre",type="2","current",type="3","post")

Ciao.
Giuseppe

tsheets13 — Thu, 05 Mar 2020 18:07:23 GMT

Perfect! Thank you