topic How to replace specific field value? in Splunk Search

How to replace specific field value?

kdimaria — Fri, 18 Aug 2017 15:33:38 GMT

I am trying to replace a specific field. I have a table that is like:

Name Street Zip Note
John Wall 123 hello
.
.
.
So I am basically trying to change the Note column. I was doing like:
eval Note="changed note" WHERE Name="John"
to grab that specific note column and not change all of them but when I try to run that it does not work.

Re: How to replace specific field value?

cmerriman — Fri, 18 Aug 2017 16:26:36 GMT

so you're trying to change the value of the Note column when Name=John?
does this work:

|eval Note=if(Name="John","changed note",Note)

Re: How to replace specific field value?

kdimaria — Mon, 21 Aug 2017 14:10:58 GMT

Yes that works thank you 🙂

Re: How to replace specific field value?

cblanton — Wed, 24 Jul 2019 21:41:40 GMT

I'm trying to do this exact same thing but my search doesn't seem to recognize when, for example Name="John." It sets the Z value to Note, regardless. I've tried changing the Z value and that changes, but when the X matches, it doesn't return Y, only Z. So it is returning Z and not just not doing the eval all together.

| eval MedRepoCloneMergeTime=if(Event="mock", "NA", MedRepoCloneMergeTime)

When X doesn't match, it also returns Z.

Re: How to replace specific field value?

cmerriman — Thu, 25 Jul 2019 00:59:46 GMT

Have you checked that the fields are spelled correctly and capitalized properly and the field value is also correctly spelled/capped? I know it’s silly but it’s critical. The fields and values need to exist and need to be exact. Do you have example data?