https://community.splunk.com/t5/Splunk-Search/conditional-field-choice/m-p/39137#M8913 <P>Hello,</P> <P>I have log files which have both IP numbers (field IP) and corresponding names (field DNSNAME).<BR /> I would like to chart (a distribution for instance) based on the names but unfortunately some of them are not available (the value of the field DNSNAME="N/A"). In that case I need to fallback to the IP.</P> <P>If I always had names I would do</P> <PRE><CODE>... | stats count by DNSNAME </CODE></PRE> <P>Is there a way to construct something along the lines of</P> <PRE><CODE>... | stats count [ if DNSNAME != "N/A" then "by DNSNAME" else "by IP" ) ] </CODE></PRE> <P>I was looking around the <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">eval &amp; co. functions</A> but the "if" mentioned there seems to work on a given field only (while I want to modify the search itself based on conditions)</P> <P>Thanks!</P> Thu, 22 Dec 2011 10:46:56 GMT wsw70 2011-12-22T10:46:56Z https://community.splunk.com/t5/Splunk-Search/conditional-field-choice/m-p/39137#M8913 <P>Hello,</P> <P>I have log files which have both IP numbers (field IP) and corresponding names (field DNSNAME).<BR /> I would like to chart (a distribution for instance) based on the names but unfortunately some of them are not available (the value of the field DNSNAME="N/A"). In that case I need to fallback to the IP.</P> <P>If I always had names I would do</P> <PRE><CODE>... | stats count by DNSNAME </CODE></PRE> <P>Is there a way to construct something along the lines of</P> <PRE><CODE>... | stats count [ if DNSNAME != "N/A" then "by DNSNAME" else "by IP" ) ] </CODE></PRE> <P>I was looking around the <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">eval &amp; co. functions</A> but the "if" mentioned there seems to work on a given field only (while I want to modify the search itself based on conditions)</P> <P>Thanks!</P> Thu, 22 Dec 2011 10:46:56 GMT https://community.splunk.com/t5/Splunk-Search/conditional-field-choice/m-p/39137#M8913 wsw70 2011-12-22T10:46:56Z https://community.splunk.com/t5/Splunk-Search/conditional-field-choice/m-p/39138#M8914 <P>... | eval newfield=if(DNSNAME=="N/A",IP,DNSNAME) | stats count by newfield</P> Thu, 22 Dec 2011 11:15:42 GMT https://community.splunk.com/t5/Splunk-Search/conditional-field-choice/m-p/39138#M8914 imrago 2011-12-22T11:15:42Z https://community.splunk.com/t5/Splunk-Search/conditional-field-choice/m-p/39139#M8915 <P>Aahhh - I was looking at the "if" (as I mentioned) but somehow it did not ring a bell.<BR /> Thanks!</P> Thu, 22 Dec 2011 11:33:03 GMT https://community.splunk.com/t5/Splunk-Search/conditional-field-choice/m-p/39139#M8915 wsw70 2011-12-22T11:33:03Z