topic Re: How to insert dummy data into the first few entries of a field in Splunk Search

How to insert dummy data into the first few entries of a field?

splunker-0625 — Mon, 06 Feb 2023 00:11:28 GMT

Here is the original table here, but I need to put some dummy data into Field_B

Time	Filed_A	Field_B
1	10	Tom
2	20	Smith
3	30	Will
4	40	Sam

Like this,

Time	Filed_A	Field_B
1	10	DUMMY1
2	20	DUMMY2
3	30	Tom
4	40	Smith

I want to expect the order of Filed_B will be : DUMMY1,DUMMY2,Tom,Smith,Will,Sam...
Please advise me on how to write the eval command to do this...

Re: How to insert dummy data into the first few entries of a field

richgalloway — Sat, 04 Feb 2023 18:07:00 GMT

If Field_B is a multi-value field then you could use mvappend to add the values.

| eval Field_B = mvappend("DUMMY1", "DUMMY2", Field_B)

If Field_B is not multi-valued then please share the query that produced the results so we can tell you how to accomplish your goal.

Re: How to insert dummy data into the first few entries of a field

liuce1 — Sun, 05 Feb 2023 15:25:41 GMT

The SPL as below, I store your previous table in a lookup table test.csv

If my answer can help you ,please kindly vote it .

Thank you

Re: How to insert dummy data into the first few entries of a field

splunker-0625 — Mon, 06 Feb 2023 01:46:04 GMT

Hi liuce1,
Thank you for your reply
Your idea that is using autoregress, seems working for me.

I could make put some dummy data for my targeting column with a simple procedure.

Thanks,