topic Re: How to write an eval condition to replace a field ? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-condition-to-replace-a-field/m-p/308856#M92617 <P>How about this?</P> <PRE><CODE>| eval field_A=if(field_A=="not registered" AND field_B=="PROVISIONING", "regiestred but not monitored", field_A) </CODE></PRE> Thu, 22 Feb 2018 20:26:26 GMT somesoni2 2018-02-22T20:26:26Z How to write an eval condition to replace a field ? https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-condition-to-replace-a-field/m-p/308855#M92616 <P>I have a query which displays some tabular results and when a certain condition is matched for 2 field values I want to insert a new value to Field_A like below </P> <P>If field_A="not registered" and field_B="PROVISIONING" for a list of hosts then I want to change the Field_A value from "not registered" to "registered but not monitored"</P> <P>How can I write an eval condition to satisfy the above. I have some how managed to get a little further like below </P> <P>| eval field_A=if(field_A=="not registered" AND field_B=="PROVISIONING")</P> <P>Please complete the above part eval condition above if someone knows how to do it?</P> Tue, 29 Sep 2020 18:11:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-condition-to-replace-a-field/m-p/308855#M92616 pavanae 2020-09-29T18:11:00Z Re: How to write an eval condition to replace a field ? https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-condition-to-replace-a-field/m-p/308856#M92617 <P>How about this?</P> <PRE><CODE>| eval field_A=if(field_A=="not registered" AND field_B=="PROVISIONING", "regiestred but not monitored", field_A) </CODE></PRE> Thu, 22 Feb 2018 20:26:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-condition-to-replace-a-field/m-p/308856#M92617 somesoni2 2018-02-22T20:26:26Z Re: How to write an eval condition to replace a field ? https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-condition-to-replace-a-field/m-p/308857#M92618 <P>hello , Please how can i create a condition in a search to replace an event with a name , even if this event does not exist at the moment</P> Tue, 26 Mar 2019 10:57:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-condition-to-replace-a-field/m-p/308857#M92618 aalaa 2019-03-26T10:57:38Z