<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to replace field value by string if certain condition matched in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-to-replace-field-value-by-string-if-certain-condition/m-p/569476#M198485</link>
    <description>&lt;P&gt;It is Value that you need to convert to a number for the numeric comparison to work not converting the number to a string&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval Value=if(tonumber(Value)&amp;lt;=0.02,"Good",Value)&lt;/LI-CODE&gt;</description>
    <pubDate>Sun, 03 Oct 2021 11:48:42 GMT</pubDate>
    <dc:creator>ITWhisperer</dc:creator>
    <dc:date>2021-10-03T11:48:42Z</dc:date>
    <item>
      <title>How to replace field value by string if certain condition matched</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-replace-field-value-by-string-if-certain-condition/m-p/569469#M198479</link>
      <description>&lt;P&gt;How do I replace a value for a field if the value is lesser than 0.02 by "Good"?&lt;/P&gt;&lt;TABLE border="0" width="192" cellspacing="0" cellpadding="0"&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD width="64" height="19"&gt;Value&lt;/TD&gt;&lt;TD width="64"&gt;Key&lt;/TD&gt;&lt;TD width="64"&gt;date&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD height="19"&gt;0.02&lt;/TD&gt;&lt;TD&gt;1&lt;/TD&gt;&lt;TD&gt;1/1/2017&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD height="19"&gt;0.02&lt;/TD&gt;&lt;TD&gt;1&lt;/TD&gt;&lt;TD&gt;1/2/2017&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD height="19"&gt;0.05&lt;/TD&gt;&lt;TD&gt;1&lt;/TD&gt;&lt;TD&gt;1/3/2017&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD height="19"&gt;0.02&lt;/TD&gt;&lt;TD&gt;1&lt;/TD&gt;&lt;TD&gt;1/4/2017&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD height="19"&gt;0.02&lt;/TD&gt;&lt;TD&gt;1&lt;/TD&gt;&lt;TD&gt;1/5/2017&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD height="19"&gt;0.02&lt;/TD&gt;&lt;TD&gt;1&lt;/TD&gt;&lt;TD&gt;1/6/2017&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Suppose the value is lesser than 0.02, I want to replace the value by string "Good"&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;TABLE border="0" width="192" cellspacing="0" cellpadding="0"&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD width="64" height="19"&gt;Value&lt;/TD&gt;&lt;TD width="64"&gt;Key&lt;/TD&gt;&lt;TD width="64"&gt;date&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD height="19"&gt;Good&lt;/TD&gt;&lt;TD&gt;1&lt;/TD&gt;&lt;TD&gt;1/1/2017&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD height="19"&gt;Good&lt;/TD&gt;&lt;TD&gt;1&lt;/TD&gt;&lt;TD&gt;1/2/2017&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD height="19"&gt;0.05&lt;/TD&gt;&lt;TD&gt;1&lt;/TD&gt;&lt;TD&gt;1/3/2017&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD height="19"&gt;Good&lt;/TD&gt;&lt;TD&gt;1&lt;/TD&gt;&lt;TD&gt;1/4/2017&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD height="19"&gt;Good&lt;/TD&gt;&lt;TD&gt;1&lt;/TD&gt;&lt;TD&gt;1/5/2017&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD height="19"&gt;Good&lt;/TD&gt;&lt;TD&gt;1&lt;/TD&gt;&lt;TD&gt;1/6/2017&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;</description>
      <pubDate>Sun, 03 Oct 2021 08:33:14 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-replace-field-value-by-string-if-certain-condition/m-p/569469#M198479</guid>
      <dc:creator>sndpgiri</dc:creator>
      <dc:date>2021-10-03T08:33:14Z</dc:date>
    </item>
    <item>
      <title>Re: How to replace field value by string if certain condition matched</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-replace-field-value-by-string-if-certain-condition/m-p/569471#M198481</link>
      <description>&lt;LI-CODE lang="markup"&gt;| eval Value=if(Value&amp;lt;=0.02,"Good",Value)&lt;/LI-CODE&gt;</description>
      <pubDate>Sun, 03 Oct 2021 08:51:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-replace-field-value-by-string-if-certain-condition/m-p/569471#M198481</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-10-03T08:51:39Z</dc:date>
    </item>
    <item>
      <title>Re: How to replace field value by string if certain condition matched</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-replace-field-value-by-string-if-certain-condition/m-p/569472#M198482</link>
      <description>&lt;P&gt;I get this error:&amp;nbsp;&lt;BR /&gt;Error in 'eval' command: Type checking failed. The '&amp;lt;=' operator received different types.&lt;/P&gt;&lt;P&gt;When I use a single quote outside the value, I get&amp;nbsp;No result&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval Value=if(Value&amp;lt;='0.02',"Good",Value)&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;DIV class="lia-panel lia-panel-standard MessageTagsTaplet Chrome lia-component-message-view-widget-tags"&gt;&lt;DIV class="lia-decoration-border"&gt;&lt;DIV class="lia-decoration-border-top"&gt;&amp;nbsp;&lt;/DIV&gt;&lt;DIV class="lia-decoration-border-content"&gt;&lt;DIV&gt;&lt;DIV class="lia-panel-content-wrapper"&gt;&lt;DIV class="lia-panel-content"&gt;&lt;DIV class="AddMessageTags lia-message-tags"&gt;&amp;nbsp;&lt;/DIV&gt;&lt;/DIV&gt;&lt;/DIV&gt;&lt;/DIV&gt;&lt;/DIV&gt;&lt;/DIV&gt;&lt;/DIV&gt;</description>
      <pubDate>Sun, 03 Oct 2021 09:04:07 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-replace-field-value-by-string-if-certain-condition/m-p/569472#M198482</guid>
      <dc:creator>sndpgiri</dc:creator>
      <dc:date>2021-10-03T09:04:07Z</dc:date>
    </item>
    <item>
      <title>Re: How to replace field value by string if certain condition matched</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-replace-field-value-by-string-if-certain-condition/m-p/569476#M198485</link>
      <description>&lt;P&gt;It is Value that you need to convert to a number for the numeric comparison to work not converting the number to a string&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval Value=if(tonumber(Value)&amp;lt;=0.02,"Good",Value)&lt;/LI-CODE&gt;</description>
      <pubDate>Sun, 03 Oct 2021 11:48:42 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-replace-field-value-by-string-if-certain-condition/m-p/569476#M198485</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-10-03T11:48:42Z</dc:date>
    </item>
  </channel>
</rss>

