https://community.splunk.com/t5/Splunk-Search/IF-then-problems/m-p/348082#M174883 <P>Thats so simple, took me ages trying to get that working! many thanks!</P> Mon, 24 Apr 2017 10:33:21 GMT jacqu3sy 2017-04-24T10:33:21Z https://community.splunk.com/t5/Splunk-Search/IF-then-problems/m-p/348079#M174880 <P>struggling with the following IF statement....</P> <P>I have a table, and want to create a new field called 'finalclosedtime' which will be populated either by an existing field called 'closedtime' or a string IF one of the other fields contains a value of "New".</P> <P>I tried this but no joy:</P> <P>| eval finalclosedtime=if((status_label="New",stringtopopulate)closedtime)</P> <P>Any ideas? Thanks.</P> Mon, 24 Apr 2017 10:12:23 GMT https://community.splunk.com/t5/Splunk-Search/IF-then-problems/m-p/348079#M174880 jacqu3sy 2017-04-24T10:12:23Z https://community.splunk.com/t5/Splunk-Search/IF-then-problems/m-p/348080#M174881 <P>You can form the field this way -</P> <PRE><CODE>| eval finalclosedtime=if(like(status_label,"%New%"),stringtopopulate,closedtime) </CODE></PRE> Mon, 24 Apr 2017 10:19:02 GMT https://community.splunk.com/t5/Splunk-Search/IF-then-problems/m-p/348080#M174881 dineshraj9 2017-04-24T10:19:02Z https://community.splunk.com/t5/Splunk-Search/IF-then-problems/m-p/348081#M174882 <P>Hi There, try it simply as:</P> <P>| eval finalclosedtime=if(status_label="New", stringtopopulate, closedtime)</P> Mon, 24 Apr 2017 10:22:28 GMT https://community.splunk.com/t5/Splunk-Search/IF-then-problems/m-p/348081#M174882 paulbannister 2017-04-24T10:22:28Z https://community.splunk.com/t5/Splunk-Search/IF-then-problems/m-p/348082#M174883 <P>Thats so simple, took me ages trying to get that working! many thanks!</P> Mon, 24 Apr 2017 10:33:21 GMT https://community.splunk.com/t5/Splunk-Search/IF-then-problems/m-p/348082#M174883 jacqu3sy 2017-04-24T10:33:21Z https://community.splunk.com/t5/Splunk-Search/IF-then-problems/m-p/348083#M174884 <P>no problem <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 24 Apr 2017 10:35:19 GMT https://community.splunk.com/t5/Splunk-Search/IF-then-problems/m-p/348083#M174884 dineshraj9 2017-04-24T10:35:19Z https://community.splunk.com/t5/Splunk-Search/IF-then-problems/m-p/348084#M174885 <P>Also worked, thanks!</P> Mon, 24 Apr 2017 12:45:24 GMT https://community.splunk.com/t5/Splunk-Search/IF-then-problems/m-p/348084#M174885 jacqu3sy 2017-04-24T12:45:24Z https://community.splunk.com/t5/Splunk-Search/IF-then-problems/m-p/348085#M174886 <P>Great! Please accept the answer that solved the problem, and upvote any other answers that you found particularly helpful.</P> Mon, 24 Apr 2017 15:41:12 GMT https://community.splunk.com/t5/Splunk-Search/IF-then-problems/m-p/348085#M174886 DalJeanis 2017-04-24T15:41:12Z