topic Re: Edit data In Splunk in Splunk Search

Edit data In Splunk

jokovitch — Thu, 12 Aug 2021 13:08:11 GMT

I have a data in Splunk like

index="main"

I want to add and change some data

where Fname="fname1" I want to edit that Country = UK and add field of Phone =123

The final data will be

How can I do that?

anilchaithu — Thu, 12 Aug 2021 13:18:35 GMT

you can use the below eval command for this task

eval Country = if(Fname="fname1", "UK", Fname), Phone= case(Fname="fname1", "123")

-- Hope this helps

jokovitch — Thu, 12 Aug 2021 13:31:50 GMT

index="main" |eval Phone= case(Fname="fname1", "123")

I have tried this command , but nothing changed

anilchaithu — Thu, 12 Aug 2021 14:15:54 GMT

strange, try this.

index="main" | eval Phone= case(like(Fname, "%fname1%", "123")

-- Hope this helps

gcusello — Thu, 12 Aug 2021 14:25:22 GMT

as @anilchaithu hinted, the correct search should be:

index=main | eval Country=if(Fname="fname1","UK",Country), Phone=if(Fname="fname1","123","") | table Fname Phone Country

if it doesn't run, check the fieldname (fields are case sensitive).

If doesn't run, please describe results and what's error.

Ciao.

Giuseppe

jokovitch — Sun, 15 Aug 2021 07:39:37 GMT

You need to change

index="main" | eval Phone= case(like(Fname, "%fname1%", "123")

index="main" | eval Phone= case(like(Fname, "%fname1%"), "123")

That still not change the data

Do I need to put this query in another place then New Search screen ? Or maybe is there place that I need to mark to commit this data?

jokovitch — Sun, 22 Aug 2021 12:29:24 GMT

Do you have any idea how to fix that ?