https://community.splunk.com/t5/Splunk-Search/How-to-populate-field-B-with-field-A-or-field-B-depending-if/m-p/610512#M212328 <LI-CODE lang="markup">| eval FieldB=if(like(computername, "ABC%"), "Yes", FieldC)</LI-CODE> Tue, 23 Aug 2022 15:14:01 GMT ITWhisperer 2022-08-23T15:14:01Z https://community.splunk.com/t5/Splunk-Search/How-to-populate-field-B-with-field-A-or-field-B-depending-if/m-p/610508#M212324 <P>I can't figure out the correct syntax for the second eval statement or what else I should use instead of eval. I know the second eval statement syntax is incorrect, I am just placing it here so you can understand what I am trying to accomplish.</P> <P>| eval FieldA=if(like(computername, "ABC%"), "Yes", "No")<BR />| eval FieldB = if FieldA="No", then FieldB = FieldC, else FieldB = FieldA</P> <P>Thank you!</P> Tue, 23 Aug 2022 15:27:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-populate-field-B-with-field-A-or-field-B-depending-if/m-p/610508#M212324 jalo23 2022-08-23T15:27:12Z https://community.splunk.com/t5/Splunk-Search/How-to-populate-field-B-with-field-A-or-field-B-depending-if/m-p/610512#M212328 <LI-CODE lang="markup">| eval FieldB=if(like(computername, "ABC%"), "Yes", FieldC)</LI-CODE> Tue, 23 Aug 2022 15:14:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-populate-field-B-with-field-A-or-field-B-depending-if/m-p/610512#M212328 ITWhisperer 2022-08-23T15:14:01Z https://community.splunk.com/t5/Splunk-Search/How-to-populate-field-B-with-field-A-or-field-B-depending-if/m-p/610513#M212329 <P>Thank you, I appreciate your super-fast response! works perfectly!</P> Tue, 23 Aug 2022 15:24:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-populate-field-B-with-field-A-or-field-B-depending-if/m-p/610513#M212329 jalo23 2022-08-23T15:24:53Z