https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-setfields-quot-command-to-assign-the-value-based/m-p/511625#M143435 <P>Hi</P><P>I think that eval is better on this case.</P><P>eval fieldA = fieldB&nbsp;</P><P>is enough to copy fieldB values to fieldA.</P><P>r. Ismo</P> Wed, 29 Jul 2020 20:09:27 GMT isoutamo 2020-07-29T20:09:27Z https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-setfields-quot-command-to-assign-the-value-based/m-p/511618#M143430 <P>I want to use the setfields command to set fieldA to a particular value.&nbsp; That value is located in fieldB.&nbsp; How can I make setfields take the value of the field rather then the field name.&nbsp; setfields fieldA=fieldB sets A to the string "fieldB".</P> <P>&nbsp;</P> <P>Thanks.</P> Wed, 29 Jul 2020 19:36:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-setfields-quot-command-to-assign-the-value-based/m-p/511618#M143430 sirching 2020-07-29T19:36:07Z https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-setfields-quot-command-to-assign-the-value-based/m-p/511625#M143435 <P>Hi</P><P>I think that eval is better on this case.</P><P>eval fieldA = fieldB&nbsp;</P><P>is enough to copy fieldB values to fieldA.</P><P>r. Ismo</P> Wed, 29 Jul 2020 20:09:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-setfields-quot-command-to-assign-the-value-based/m-p/511625#M143435 isoutamo 2020-07-29T20:09:27Z https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-setfields-quot-command-to-assign-the-value-based/m-p/511630#M143438 <P>My FieldA contains a mixture of 2 values, OSType and Null, total count is 587.&nbsp; My Field B contains 1 value OSType and has a count of 4.&nbsp; &nbsp;</P><P>&nbsp;</P><P>I am trying to set the 587 count of FieldA values to value of the OSType.&nbsp; &nbsp;Based on this scenario, what do you suggest.&nbsp; In the end I want all 587 FieldA values to equal the OSType, thus eliminating the Null value.</P><P>&nbsp;</P><P>Thanks</P> Wed, 29 Jul 2020 20:56:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-setfields-quot-command-to-assign-the-value-based/m-p/511630#M143438 sirching 2020-07-29T20:56:46Z https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-setfields-quot-command-to-assign-the-value-based/m-p/511634#M143441 <LI-CODE lang="markup">| makeresults | eval FieldA=split("OStype,,OStypes,OStype,,OStype",",") | mvexpand FieldA | eval FieldA=nullif(FieldA,"") | eval FieldB="OStype" | rename COMMENT as "FieldA are OStype,OStypes and NULL" | eventstats count(eval(FieldA=FieldB)) as count</LI-CODE><P><STRONG>stats() eventstats()</STRONG> and <STRONG>chart()</STRONG> can use <STRONG>eval</STRONG>.</P> Wed, 29 Jul 2020 21:15:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-setfields-quot-command-to-assign-the-value-based/m-p/511634#M143441 to4kawa 2020-07-29T21:15:45Z https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-setfields-quot-command-to-assign-the-value-based/m-p/511654#M143454 <P>Hi</P><LI-CODE lang="java">| makeresults | eval FieldA=split("OStype,,OStype,OStype,,OStype",",") | mvexpand FieldA | eval FieldA=nullif(FieldA,"") | eval FieldB="OStype" | rename COMMENT as "FieldA are OStype,OStypes and NULL" | eval FieldA = FieldB</LI-CODE> Wed, 29 Jul 2020 22:56:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-setfields-quot-command-to-assign-the-value-based/m-p/511654#M143454 isoutamo 2020-07-29T22:56:38Z https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-setfields-quot-command-to-assign-the-value-based/m-p/511886#M143534 <P>Can you post an example of your data. From your description I take it that you want to set fieldA=fieldB where fieldA is null. So, you could do</P><LI-CODE lang="markup">| eval fieldA=coalesce(fieldA, fieldB)</LI-CODE><P>which will copy fieldB to field A when field A is null.</P><P>&nbsp;</P> Fri, 31 Jul 2020 05:11:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-setfields-quot-command-to-assign-the-value-based/m-p/511886#M143534 bowesmana 2020-07-31T05:11:15Z