topic Re: Create a new field using other field values concatenated in Splunk Search https://community.splunk.com/t5/Splunk-Search/Create-a-new-field-using-other-field-values-concatenated/m-p/699438#M237438 <PRE><SPAN>| eval description=if('app'=="linux", host. "-" .alert_type',&nbsp; 'app'==windows, host. "-" .severity, "false")</SPAN></PRE><P>You didn't nest the second IF statement</P><PRE><SPAN>| eval description=if('app'=="linux", host. "-" .alert_type',if('app'==windows, host. "-" .severity, "false"))</SPAN></PRE> Wed, 18 Sep 2024 16:31:15 GMT dural_yyz 2024-09-18T16:31:15Z Create a new field using other field values concatenated https://community.splunk.com/t5/Splunk-Search/Create-a-new-field-using-other-field-values-concatenated/m-p/699437#M237437 <P>I am trying to create a new field called "description" that contains values from two other existing fields.&nbsp;</P> <P>If field "app" is equal to linux than i want to combine existing fields "host" and "alert_type".<BR /><BR />If field "app" is equal to windows than i want to combine existing field values "host" and "severity"</P> <P>If app equals anything else, i want the value to be false.&nbsp;<BR /><BR />Below is the eval i have, buts its not working:</P> <P>&nbsp;</P> <LI-CODE lang="markup">| eval description=if('app'=="linux", host. "-" .alert_type', 'app'==windows, host. "-" .severity, "false")</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> Wed, 18 Sep 2024 19:06:40 GMT https://community.splunk.com/t5/Splunk-Search/Create-a-new-field-using-other-field-values-concatenated/m-p/699437#M237437 scout29 2024-09-18T19:06:40Z Re: Create a new field using other field values concatenated https://community.splunk.com/t5/Splunk-Search/Create-a-new-field-using-other-field-values-concatenated/m-p/699438#M237438 <PRE><SPAN>| eval description=if('app'=="linux", host. "-" .alert_type',&nbsp; 'app'==windows, host. "-" .severity, "false")</SPAN></PRE><P>You didn't nest the second IF statement</P><PRE><SPAN>| eval description=if('app'=="linux", host. "-" .alert_type',if('app'==windows, host. "-" .severity, "false"))</SPAN></PRE> Wed, 18 Sep 2024 16:31:15 GMT https://community.splunk.com/t5/Splunk-Search/Create-a-new-field-using-other-field-values-concatenated/m-p/699438#M237438 dural_yyz 2024-09-18T16:31:15Z