https://community.splunk.com/t5/Splunk-Search/Two-fields-same-value-fill-in-third-field/m-p/372584#M162976 <P>How are the values <CODE>NT1</CODE> and <CODE>NT2</CODE> determined for the last two events in your example output? </P> Sun, 11 Feb 2018 16:59:58 GMT micahkemp 2018-02-11T16:59:58Z https://community.splunk.com/t5/Splunk-Search/Two-fields-same-value-fill-in-third-field/m-p/372583#M162975 <P>My dataset has three fields from two different data sources. Two fields are identical (hostnames with different field names). One dataset has a third field that I would like to fill in. Example:</P> <P>sourcetype . hostname1 computer1 . domain<BR /> source1 . host1 . NT1<BR /> source1 . host2 NT2<BR /> source2 host1<BR /> source2 host2</P> <P>Want to it to be:</P> <P>sourcetype . hostname1 computer1 . domain<BR /> source1 . host1 . host1 NT1<BR /> source1 . host2 host2 NT2<BR /> source2 host1 host1 NT1<BR /> source2 host2 host2 . NT2</P> Sun, 11 Feb 2018 06:21:02 GMT https://community.splunk.com/t5/Splunk-Search/Two-fields-same-value-fill-in-third-field/m-p/372583#M162975 rocarril 2018-02-11T06:21:02Z https://community.splunk.com/t5/Splunk-Search/Two-fields-same-value-fill-in-third-field/m-p/372584#M162976 <P>How are the values <CODE>NT1</CODE> and <CODE>NT2</CODE> determined for the last two events in your example output? </P> Sun, 11 Feb 2018 16:59:58 GMT https://community.splunk.com/t5/Splunk-Search/Two-fields-same-value-fill-in-third-field/m-p/372584#M162976 micahkemp 2018-02-11T16:59:58Z https://community.splunk.com/t5/Splunk-Search/Two-fields-same-value-fill-in-third-field/m-p/372585#M162977 <P>| eval Domain=case(<BR /> hostname1="host1" AND computername1="host1", "NT1", <BR /> hostname1="host2" AND computername1="host2", "NT2") </P> <P>Same can achieve via lookup if you have large no of values to be created.</P> Mon, 12 Feb 2018 05:14:13 GMT https://community.splunk.com/t5/Splunk-Search/Two-fields-same-value-fill-in-third-field/m-p/372585#M162977 Kwip 2018-02-12T05:14:13Z