https://community.splunk.com/t5/Splunk-Search/Want-to-replace-the-field-value-name/m-p/660388#M227973 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225469">@ramkyreddy</a>,</P><P>what exactly is your requirement?</P><LI-CODE lang="markup">&lt;your_search&gt; | eval sku = if(name="",substr(kit,0,5),substr(name,0,5)) | eval sku=case(sku="NAC-D","ANT-P",sku="DHV-K","ABD-U",true(),sku)</LI-CODE><P>the search should work.</P><P>&nbsp;Ciao.</P><P>giuseppe</P> Wed, 11 Oct 2023 12:04:19 GMT gcusello 2023-10-11T12:04:19Z https://community.splunk.com/t5/Splunk-Search/Want-to-replace-the-field-value-name/m-p/660386#M227972 <TABLE width="351"> <TBODY> <TR> <TD width="145">Name</TD> <TD width="55">sku</TD> <TD width="151">kit</TD> </TR> </TBODY> </TABLE> <TABLE width="351"> <TBODY> <TR> <TD width="145">NAC-D-CDSK-DLS-05.90</TD> <TD width="55">NAC-D</TD> <TD width="151">HJA-JEOE-DNDN-94.4.0</TD> </TR> </TBODY> </TABLE> <P><BR />This my data, I want to replace&nbsp; with NAC-D to ANT-P for multiple values<BR />this is my search query</P> <LI-CODE lang="markup">| eval sku = if(name=="",substr(kit,0,5),substr(name,0,5)) | eval sku=case(sku =="NAC-D","ANT-P ",sku =="DHV-K","ABD-U",true(),sku)</LI-CODE> <P><BR /><BR /></P> Wed, 11 Oct 2023 12:05:52 GMT https://community.splunk.com/t5/Splunk-Search/Want-to-replace-the-field-value-name/m-p/660386#M227972 ramkyreddy 2023-10-11T12:05:52Z https://community.splunk.com/t5/Splunk-Search/Want-to-replace-the-field-value-name/m-p/660388#M227973 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225469">@ramkyreddy</a>,</P><P>what exactly is your requirement?</P><LI-CODE lang="markup">&lt;your_search&gt; | eval sku = if(name="",substr(kit,0,5),substr(name,0,5)) | eval sku=case(sku="NAC-D","ANT-P",sku="DHV-K","ABD-U",true(),sku)</LI-CODE><P>the search should work.</P><P>&nbsp;Ciao.</P><P>giuseppe</P> Wed, 11 Oct 2023 12:04:19 GMT https://community.splunk.com/t5/Splunk-Search/Want-to-replace-the-field-value-name/m-p/660388#M227973 gcusello 2023-10-11T12:04:19Z https://community.splunk.com/t5/Splunk-Search/Want-to-replace-the-field-value-name/m-p/669014#M229475 <P>thanks,&nbsp; I got expected&nbsp; output</P> Fri, 17 Nov 2023 13:40:57 GMT https://community.splunk.com/t5/Splunk-Search/Want-to-replace-the-field-value-name/m-p/669014#M229475 ramkyreddy 2023-11-17T13:40:57Z https://community.splunk.com/t5/Splunk-Search/Want-to-replace-the-field-value-name/m-p/669073#M229493 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225469">@ramkyreddy</a>&nbsp;,</P><P>good for you, see next time!</P><P>Ciao and happy splunking</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Sat, 18 Nov 2023 06:47:47 GMT https://community.splunk.com/t5/Splunk-Search/Want-to-replace-the-field-value-name/m-p/669073#M229493 gcusello 2023-11-18T06:47:47Z