topic Re: How to Build an If Statement based on if a field contains a string in Splunk Search

How to Build an If Statement based on if a field contains a string

katzr — Mon, 08 Jan 2018 19:03:24 GMT

For every record where the field Test contains the word "Please" - I want to replace the string with "This is a test", below is the logic I am applying and it is not working- I tried using case, like, and a changed from " to ' and = to == but I cannot get anything to work.

| eval Test=if(Test=="Please", "This is a test", Test)

Re: How to Build an If Statement based on if a field contains a string

somesoni2 — Mon, 08 Jan 2018 19:07:57 GMT

Try like this

...| eval Test=if(match(Test,"Please"),"This is a test", Test)

The equal sign does the exact comparison (value should match exactly). Since you want to check for "contains", you can use match(Test,"Please") or like(Test,"%Please%").

Re: How to Build an If Statement based on if a field contains a string

katzr — Mon, 08 Jan 2018 19:21:36 GMT

thank you this works!