topic Re: Have field a equal field b if event_type = xxx in Splunk Search

Have field a equal field b if event_type = xxx

bt149 — Mon, 07 Feb 2022 18:05:30 GMT

I have a search that is based on two events types - admin_login and admin_change. Admin_Login has two fields that the admin_change does not. Those fields are "admin_login_name" and "admin_login_email."

The fields, other than those two previously mentioned, are the same. What I'm looking to do:

If event_type=admin_login then admin_login_name = source_user_name AND admin_login_email = source_user_email.

Thanks in advance for the help.

Re: Have field a equal field b if event_type = xxx

ITWhisperer — Mon, 07 Feb 2022 18:49:17 GMT

| eval admin_login_name=if(event_type="admin_login",source_user_name,admin_login_name) | eval admin_login_email=if(event_type="admin_login",source_user_email,admin_login_email)

Re: Have field a equal field b if event_type = xxx

bt149 — Mon, 07 Feb 2022 20:00:05 GMT

Thank you very much. I definitely over thought this one.