https://community.splunk.com/t5/Splunk-Search/Using-field-eval-values-in-if-condition/m-p/381101#M172225 <P>Try this</P> <PRE><CODE>....| eval Srvr=coalesce(Field_1, Field_2, "NA") | table ....rest of the command </CODE></PRE> Wed, 27 Mar 2019 18:10:12 GMT somesoni2 2019-03-27T18:10:12Z https://community.splunk.com/t5/Splunk-Search/Using-field-eval-values-in-if-condition/m-p/381100#M172224 <P>I have a search as below:</P> <P>|rex field=Field "^(?.+?)." <BR /> | eval Srvr = if(sourcetype="Type_1", Field_1 , if(sourcetype="Type_2", Field_2, "NA")) <BR /> | table Id sourcetype Field_1 Srvr </P> <P>I have two fields<BR /> Field_1 that is in sourcetype="Type_1"<BR /> Field_2 that is in sourcetype="Type_2"<BR /> I want to take the values of these field in one field that is Srvr in the searxh above.</P> <P>Please suggest as the query is not picking up the values from the fields Field_1 and Filed_2 but the if condition is working with harcoded values.</P> Tue, 29 Sep 2020 23:52:53 GMT https://community.splunk.com/t5/Splunk-Search/Using-field-eval-values-in-if-condition/m-p/381100#M172224 veerendra_modi 2020-09-29T23:52:53Z https://community.splunk.com/t5/Splunk-Search/Using-field-eval-values-in-if-condition/m-p/381101#M172225 <P>Try this</P> <PRE><CODE>....| eval Srvr=coalesce(Field_1, Field_2, "NA") | table ....rest of the command </CODE></PRE> Wed, 27 Mar 2019 18:10:12 GMT https://community.splunk.com/t5/Splunk-Search/Using-field-eval-values-in-if-condition/m-p/381101#M172225 somesoni2 2019-03-27T18:10:12Z