topic Re: Calculated Field to replace value of field in Splunk Search

How to calculate field to replace value of field?

jason_hotchkiss — Mon, 20 Mar 2023 16:54:31 GMT

Hello -

I have a table with the following:

host

HOST	FQDN	DNS_NAME	HOST_MATCH	INDEX
hostalpha	hosta.mydomain.com	hosta	false	index_a
hosta	host	-	true	index_b

Created from the following search:

base_search
| rex field=FQDN ""^(?<DNS_NAME>[^.]+)\..*$"
| fillnull value="-" DNS_NAME
|eval HOST_MATCH="if(host='DNS_NAME',"true","false")

How would I replace the do the following:

1. If HOST != DNS_NAME, Make HOST = DNS_NAME
2. If DNS_NAME = "-" MAKE DNS_NAME = HOST

Thanks!

Re: Calculated Field to replace value of field

ITWhisperer — Mon, 20 Mar 2023 16:30:18 GMT

Just do the evaluations in the opposite order

| eval DNS_NAME=if(DNS_NAME == "-", HOST, DNS_NAME) | eval HOST=if(HOST != DNS_NAME, DNS_NAME, HOST)

Re: Calculated Field to replace value of field

jason_hotchkiss — Mon, 20 Mar 2023 16:36:13 GMT

@ITWhisperer thank you. I was way overthinking this. Much appreicated!