https://community.splunk.com/t5/Splunk-Search/eval-if-blank-field/m-p/404205#M171936 <P>Hi,</P> <P>Try below query</P> <PRE><CODE>&lt;yoursearch&gt; | eval final_destination = if(destination="", if(dest_ip="", dest_device, dest_ip), destination) </CODE></PRE> <P>You can try <CODE>coalesce</CODE> function in eval as well, have a look at <A href="https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/ConditionalFunctions#coalesce.28X.2C....29">https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/ConditionalFunctions#coalesce.28X.2C....29</A></P> Wed, 10 Apr 2019 10:56:40 GMT harsmarvania57 2019-04-10T10:56:40Z https://community.splunk.com/t5/Splunk-Search/eval-if-blank-field/m-p/404204#M171935 <P>Hi,</P> <P>Can I use multiple field values to substitute a blank value?</P> <P>Currently have;</P> <P>| eval final_destination = if(destination="", dest_ip, destination)\</P> <P>How would I add additional fields to this command? so that if dest_ip was also blank, use dest_device instead?</P> Wed, 30 Sep 2020 00:04:19 GMT https://community.splunk.com/t5/Splunk-Search/eval-if-blank-field/m-p/404204#M171935 jacqu3sy 2020-09-30T00:04:19Z https://community.splunk.com/t5/Splunk-Search/eval-if-blank-field/m-p/404205#M171936 <P>Hi,</P> <P>Try below query</P> <PRE><CODE>&lt;yoursearch&gt; | eval final_destination = if(destination="", if(dest_ip="", dest_device, dest_ip), destination) </CODE></PRE> <P>You can try <CODE>coalesce</CODE> function in eval as well, have a look at <A href="https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/ConditionalFunctions#coalesce.28X.2C....29">https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/ConditionalFunctions#coalesce.28X.2C....29</A></P> Wed, 10 Apr 2019 10:56:40 GMT https://community.splunk.com/t5/Splunk-Search/eval-if-blank-field/m-p/404205#M171936 harsmarvania57 2019-04-10T10:56:40Z https://community.splunk.com/t5/Splunk-Search/eval-if-blank-field/m-p/404206#M171937 <P>star! thanks.</P> Wed, 10 Apr 2019 11:20:50 GMT https://community.splunk.com/t5/Splunk-Search/eval-if-blank-field/m-p/404206#M171937 jacqu3sy 2019-04-10T11:20:50Z