topic Re: How can I assign a field value to a variable using eval? in Splunk Search

How can I assign a field value to a variable using eval?

mjlsnombrado — Tue, 20 Feb 2018 02:58:35 GMT

I want to assign a specific field value to a variable I want to do something like this:

|eval output = ('Fieldname'=fieldvalue)

Re: How can I assign a field value to a variable using eval?

MuS — Tue, 20 Feb 2018 03:27:16 GMT

Hi mjlsnombrado,

If I understand your question correct, you can do this:

.... | eval output=fieldname

But if you actually want to use a value of a field as new field name, you can do this:

.... | eval foo="bar", someother_field="baz", {foo}=someother_field

this will create a kv like this bar="baz".

Hope this helps ...

cheers, MuS

Re: How can I assign a field value to a variable using eval?

mjlsnombrado — Tue, 20 Feb 2018 05:32:09 GMT

Thanks 🙂 , but what I want is to set a field value to a variable, for example "fieldname" contains "A" and "B", I want to create a new field named "output" and it will contain "B" (output= B)

Re: How can I assign a field value to a variable using eval?

493669 — Tue, 20 Feb 2018 05:47:09 GMT

@mjlsnombrado how does fieldname value is ? is it fieldname= "A B" or "A and B"

Re: How can I assign a field value to a variable using eval?

mjlsnombrado — Tue, 20 Feb 2018 06:04:56 GMT

It is "A and B "

Re: How can I assign a field value to a variable using eval?

493669 — Tue, 20 Feb 2018 06:09:12 GMT

Try this:

...| eval splitted=split(Field, "and")|eval output =mvindex(splitted,1)

Try this run anywhere search:

|makeresults|eval Field="A and  B"| eval splitted=split(Field, "and")|eval output =mvindex(splitted,1)

Re: How can I assign a field value to a variable using eval?

smoir_splunk — Sun, 20 Oct 2019 21:26:04 GMT

Depending on your use case, coalesce might also do what you need: https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/ConditionalFunctions#coalesce.28X.2C....29