https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218270#M64143 <P>Have you tried the search posted by me?</P> Fri, 08 Jan 2016 10:58:35 GMT renjith_nair 2016-01-08T10:58:35Z https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218263#M64136 <P>Hi all,</P> <P>How do I write an eval statement to fetch the value of field2 corresponding to field1?<BR /> For example, consider the table below:</P> <PRE><CODE>field1 field2 Orange 10 apple 12 potato 13 </CODE></PRE> <P>If field1 value is orange, I want to assign a value of abc as corresponding field2 ..here it is 10<BR /> ..|eval abc= value of field2 for orange..</P> <P>Kindly help me in writing the search.</P> <P>Thanks in advance<BR /> Muthu</P> Fri, 08 Jan 2016 07:15:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218263#M64136 muthvin 2016-01-08T07:15:25Z https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218264#M64137 <P>Try this:</P> <PRE><CODE>yoursearch | eval field2 = if(match(field1,"Orange")), field1, field2) </CODE></PRE> <P>If field1 matches Orange, then assign field1 to field2, else assign field2</P> Fri, 08 Jan 2016 07:25:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218264#M64137 javiergn 2016-01-08T07:25:54Z https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218265#M64138 <P>thanks for your reply:<BR /> Here im trying to create another field3<BR /> as per your suggestion im getting output like<BR /> field1 field2 field3<BR /> Orange 10 10<BR /> apple 12 12<BR /> potato 13 13</P> <P>but i would like to have result as below:<BR /> field1 field2 field3<BR /> Orange 10 10<BR /> apple 12 10<BR /> potato 13 10</P> Fri, 08 Jan 2016 07:34:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218265#M64138 muthvin 2016-01-08T07:34:57Z https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218266#M64139 <PRE><CODE>&lt;your search&gt; |eval abc=if(field1=="Orange",field2,"")|eventstats values(abc) as abc </CODE></PRE> Fri, 08 Jan 2016 07:41:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218266#M64139 renjith_nair 2016-01-08T07:41:41Z https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218267#M64140 <P>try:<BR /> yoursearch| eval abc= if(match(field1,"Orange")), field2, field2) | eval field3 = if(match(field1,"Orange")), field2, abc) </P> Fri, 08 Jan 2016 08:20:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218267#M64140 fdi01 2016-01-08T08:20:31Z https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218268#M64141 <P>Hi, so assuming you want to set the value of field3 in ALL your events to be field2 when field1 matches Orange, this is what I would do:</P> <PRE><CODE>| inputcsv mycsv.csv | join type=left [ | inputcsv mycsv.csv | search field1 = "Orange" | eval fieldNEW = field2 | fields fieldNEW ] | eval field3 = fieldNEW | fields - fieldNEW </CODE></PRE> <P>mycsv.csv is just a csv matching the content of your table:</P> <PRE><CODE>field1 field2 field3 Orange 10 11 apple 12 12 potato 13 13 </CODE></PRE> <P>And the query returns the following:</P> <PRE><CODE>field1 field2 field3 Orange 10 10 apple 12 10 potato 13 10 </CODE></PRE> Fri, 08 Jan 2016 08:36:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218268#M64141 javiergn 2016-01-08T08:36:44Z https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218269#M64142 <P>Hi,<BR /> also here if i want to save the value of field2 corresponding to filed1 value orange say here is 10 as another variable abc..how can i do that?</P> Fri, 08 Jan 2016 10:32:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218269#M64142 muthvin 2016-01-08T10:32:59Z https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218270#M64143 <P>Have you tried the search posted by me?</P> Fri, 08 Jan 2016 10:58:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218270#M64143 renjith_nair 2016-01-08T10:58:35Z https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218271#M64144 <P>thx Mr renjith.nair you are right</P> Fri, 08 Jan 2016 11:10:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218271#M64144 fdi01 2016-01-08T11:10:58Z https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218272#M64145 <P>yes it is working for me..thx</P> Mon, 11 Jan 2016 05:54:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218272#M64145 muthvin 2016-01-11T05:54:56Z https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218273#M64146 <P>hi all,<BR /> With your previous suggestion i can able to create a parameter like in field3,but i want field pass and fail should get calculated like below.</P> <P>Need your help!</P> <P>field1 field2 field3 pass fail<BR /> Orange 10 10 10 0<BR /> apple 9 10 9 1<BR /> potato 7 10 7 3</P> Mon, 11 Jan 2016 07:38:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218273#M64146 muthvin 2016-01-11T07:38:15Z https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218274#M64147 <P>Pass or fail based on what and how?</P> Mon, 11 Jan 2016 08:10:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218274#M64147 renjith_nair 2016-01-11T08:10:33Z https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218275#M64148 <P>Pass = field3-field2<BR /> fail = field2-field3</P> Mon, 11 Jan 2016 09:22:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218275#M64148 muthvin 2016-01-11T09:22:27Z https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218276#M64149 <P>Did you try |eval Pass=field3-field2|eval Fail=Field2-Field2 ?</P> Mon, 11 Jan 2016 09:39:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218276#M64149 renjith_nair 2016-01-11T09:39:18Z https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218277#M64150 <P>yes i did Ranjith, but unfortunately im getting result for only one row not for all rows..Actually i'm struck here..</P> <P>field1 field2 field3 pass fail<BR /> Orange 10 10 10 0<BR /> apple 9 10 <BR /> potato 7 10 </P> <P>How to make this calculations happen to all rows?</P> Mon, 11 Jan 2016 09:55:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218277#M64150 muthvin 2016-01-11T09:55:29Z https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218278#M64151 <P>what i'm trying to do here is:<BR /> step1: i will check for field1 value..if it is orange<BR /> step2: fetch the corresponding value in field2..here the value is 10<BR /> step3: Assign this value to abc..such that abc=10<BR /> step4: eval new field pass =field2-abc..if it is equal to zero then value =abc else<BR /> step5: eval new field fail - gives the difference and provide me the difference.</P> Mon, 11 Jan 2016 10:03:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218278#M64151 muthvin 2016-01-11T10:03:20Z https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218279#M64152 <P>Try this</P> <PRE><CODE>your search |eval field3=if(field1=="Orange",field2,"")|eventstats values(field3) as field3 |eval field3=mvindex(field3,1)|eval status=if(field2==field3,field2,(field2-field3)) |table sourcetype field2 field3 status </CODE></PRE> <P>Or</P> <PRE><CODE> your search |eval field3=if(field1=="Orange",field2,"")|eventstats values(field3) as field3 |eval field3=mvindex(field3,1)|eval status=if(field2==field3,"Pass (".field2.")","Fail (".(field2-field3).")") |table sourcetype field2 field3 status </CODE></PRE> <P>OR </P> <PRE><CODE>Your search |eval field3=if(field1=="Orange",field2,"")|eventstats values(field3) as field3 |eval field3=mvindex(field3,1)|eval pass=if(field2==field3,field2,"")|eval fail=if(field2==field3,"",(field2-field3)) |table sourcetype field2 field3 pass fail </CODE></PRE> Mon, 11 Jan 2016 10:32:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218279#M64152 renjith_nair 2016-01-11T10:32:29Z https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218280#M64153 <P>will you be able to explain me why we need to use mvindex here after assigning values(field3) as field3 ?</P> Mon, 11 Jan 2016 10:54:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218280#M64153 muthvin 2016-01-11T10:54:25Z https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218281#M64154 <P>Because in eventstats we are taking values(field3) which is a list includes "" and value. To get the value from a multivalue field we use mvindex<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Parsemultivaluefields">http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Parsemultivaluefields</A></P> Mon, 11 Jan 2016 12:03:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-search-to-fetch-the-value-of-field2/m-p/218281#M64154 renjith_nair 2016-01-11T12:03:11Z