topic Re: Can I use an eval if statement to create a new field based on a value? in Splunk Search https://community.splunk.com/t5/Splunk-Search/Can-I-use-an-eval-if-statement-to-create-a-new-field-based-on-a/m-p/251467#M75147 <PRE><CODE>| eval newfield=if(field1=0 and field2=0,1,null) </CODE></PRE> Mon, 11 Jul 2016 14:46:03 GMT twinspop 2016-07-11T14:46:03Z Can I use an eval if statement to create a new field based on a value? https://community.splunk.com/t5/Splunk-Search/Can-I-use-an-eval-if-statement-to-create-a-new-field-based-on-a/m-p/251464#M75144 <P>I would like to use an if statement to create a new field based on a value. Something like if field1=0 and field2=0, then create new field with value of 1.</P> Mon, 11 Jul 2016 14:39:12 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-use-an-eval-if-statement-to-create-a-new-field-based-on-a/m-p/251464#M75144 chadman 2016-07-11T14:39:12Z Re: Can I use an eval if statement to create a new field based on a value? https://community.splunk.com/t5/Splunk-Search/Can-I-use-an-eval-if-statement-to-create-a-new-field-based-on-a/m-p/251465#M75145 <P>Hi, you can use that. Follow an old question about it: <A href="https://answers.splunk.com/answers/10947/if-statement-with-multiple-tests.html">https://answers.splunk.com/answers/10947/if-statement-with-multiple-tests.html</A></P> Mon, 11 Jul 2016 14:42:25 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-use-an-eval-if-statement-to-create-a-new-field-based-on-a/m-p/251465#M75145 gfreitas 2016-07-11T14:42:25Z Re: Can I use an eval if statement to create a new field based on a value? https://community.splunk.com/t5/Splunk-Search/Can-I-use-an-eval-if-statement-to-create-a-new-field-based-on-a/m-p/251466#M75146 <P>Perfect! thanks!</P> Mon, 11 Jul 2016 14:44:18 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-use-an-eval-if-statement-to-create-a-new-field-based-on-a/m-p/251466#M75146 chadman 2016-07-11T14:44:18Z Re: Can I use an eval if statement to create a new field based on a value? https://community.splunk.com/t5/Splunk-Search/Can-I-use-an-eval-if-statement-to-create-a-new-field-based-on-a/m-p/251467#M75147 <PRE><CODE>| eval newfield=if(field1=0 and field2=0,1,null) </CODE></PRE> Mon, 11 Jul 2016 14:46:03 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-use-an-eval-if-statement-to-create-a-new-field-based-on-a/m-p/251467#M75147 twinspop 2016-07-11T14:46:03Z Re: Can I use an eval if statement to create a new field based on a value? https://community.splunk.com/t5/Splunk-Search/Can-I-use-an-eval-if-statement-to-create-a-new-field-based-on-a/m-p/251468#M75148 <P>If you want to use case statement this may helps </P> <P>search | eval newfield=case(field1=field2,1,1=1,0)</P> Mon, 11 Jul 2016 14:48:33 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-use-an-eval-if-statement-to-create-a-new-field-based-on-a/m-p/251468#M75148 splunkton 2016-07-11T14:48:33Z