https://community.splunk.com/t5/Splunk-Search/Help-with-EVAL-statement/m-p/58353#M14266 <P>This will work:</P> <PRE><CODE>&lt;your search&gt; | eval Severity_string = case(Severity == 1, "Low", Severity == 2, "Medium", Severity == 3, "High", Severity == 4, "Critical") </CODE></PRE> <P>Then just use Severity_string in table or whatever you use to display the results.</P> Thu, 26 Jan 2012 14:43:12 GMT bojanz 2012-01-26T14:43:12Z https://community.splunk.com/t5/Splunk-Search/Help-with-EVAL-statement/m-p/58352#M14265 <P>I am extracting a field called "Severity" out of an XML data feed. and the values that are returned are severity 1, severity 2, severity 3, severity 4. I would like to re-assign the values to now say Low (instead of severity 1), Medium (instead of severity 2), High (instead of severity 3), Critical (instead of severity 4).</P> <P>I am certain than an EVAL statement would work here, but not sure what the syntax is.</P> <P>Any suggestions?</P> Thu, 26 Jan 2012 14:36:18 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-EVAL-statement/m-p/58352#M14265 efelder0 2012-01-26T14:36:18Z https://community.splunk.com/t5/Splunk-Search/Help-with-EVAL-statement/m-p/58353#M14266 <P>This will work:</P> <PRE><CODE>&lt;your search&gt; | eval Severity_string = case(Severity == 1, "Low", Severity == 2, "Medium", Severity == 3, "High", Severity == 4, "Critical") </CODE></PRE> <P>Then just use Severity_string in table or whatever you use to display the results.</P> Thu, 26 Jan 2012 14:43:12 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-EVAL-statement/m-p/58353#M14266 bojanz 2012-01-26T14:43:12Z