https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-value-of-one-field-if-the-value-of-another/m-p/187790#M54128 <P>Hi,</P> <P>I have 2 data logs "datasource1" and "datasource2", under same sourcetype name="DATALOGS", for e.g.</P> <P>datasource1</P> <P>variable1=111</P> <P>variable2= 222</P> <P>variable3= 333</P> <HR /> <P>datasource2</P> <P>variable1=aaa</P> <P>variable2= bbb</P> <P>variable3= ccc</P> <P>Now i want to get the value of variable1, if and only if variable2 value matches "123".</P> <P>How to do this. Please Help...!!!</P> Sun, 22 Dec 2013 19:25:26 GMT harshal_chakran 2013-12-22T19:25:26Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-value-of-one-field-if-the-value-of-another/m-p/187790#M54128 <P>Hi,</P> <P>I have 2 data logs "datasource1" and "datasource2", under same sourcetype name="DATALOGS", for e.g.</P> <P>datasource1</P> <P>variable1=111</P> <P>variable2= 222</P> <P>variable3= 333</P> <HR /> <P>datasource2</P> <P>variable1=aaa</P> <P>variable2= bbb</P> <P>variable3= ccc</P> <P>Now i want to get the value of variable1, if and only if variable2 value matches "123".</P> <P>How to do this. Please Help...!!!</P> Sun, 22 Dec 2013 19:25:26 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-value-of-one-field-if-the-value-of-another/m-p/187790#M54128 harshal_chakran 2013-12-22T19:25:26Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-value-of-one-field-if-the-value-of-another/m-p/187791#M54129 <PRE><CODE>... | eval myval=if(match(variable2,"123"),variable1,"") </CODE></PRE> Sun, 22 Dec 2013 20:30:18 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-value-of-one-field-if-the-value-of-another/m-p/187791#M54129 Ayn 2013-12-22T20:30:18Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-value-of-one-field-if-the-value-of-another/m-p/187792#M54130 <P>How about:</P> <PRE><CODE>variable2=123 | fields variable1 </CODE></PRE> <P>?</P> Mon, 23 Dec 2013 01:00:50 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-value-of-one-field-if-the-value-of-another/m-p/187792#M54130 gkanapathy 2013-12-23T01:00:50Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-value-of-one-field-if-the-value-of-another/m-p/187793#M54131 <P>It would b great if you can provide sample output you're expecting...</P> Mon, 23 Dec 2013 02:39:43 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-the-value-of-one-field-if-the-value-of-another/m-p/187793#M54131 somesoni2 2013-12-23T02:39:43Z