https://community.splunk.com/t5/Splunk-Search/set-a-value-at-search-time/m-p/42565#M9952 <P>I made a Union with APPEND betwenn to search :</P> <P>search1 APPEND [search2]</P> <P>I want to have a field "source" that has a specific value, depending from the source query is there a way to do somthing like :</P> <P>search1 source=1 | APPEND [search2 source=2]</P> <P>and to have results like :</P> <P>field1, field2, 1 (when comming from source1)<BR /> field1, field2, 2 (when comming from source2)</P> <P>?</P> Thu, 22 Nov 2012 08:37:08 GMT sbsbb 2012-11-22T08:37:08Z https://community.splunk.com/t5/Splunk-Search/set-a-value-at-search-time/m-p/42565#M9952 <P>I made a Union with APPEND betwenn to search :</P> <P>search1 APPEND [search2]</P> <P>I want to have a field "source" that has a specific value, depending from the source query is there a way to do somthing like :</P> <P>search1 source=1 | APPEND [search2 source=2]</P> <P>and to have results like :</P> <P>field1, field2, 1 (when comming from source1)<BR /> field1, field2, 2 (when comming from source2)</P> <P>?</P> Thu, 22 Nov 2012 08:37:08 GMT https://community.splunk.com/t5/Splunk-Search/set-a-value-at-search-time/m-p/42565#M9952 sbsbb 2012-11-22T08:37:08Z https://community.splunk.com/t5/Splunk-Search/set-a-value-at-search-time/m-p/42566#M9953 <P>Sure. Have a look at <CODE>eval</CODE> which will do what you want.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eval">http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eval</A></P> Thu, 22 Nov 2012 08:45:00 GMT https://community.splunk.com/t5/Splunk-Search/set-a-value-at-search-time/m-p/42566#M9953 Ayn 2012-11-22T08:45:00Z https://community.splunk.com/t5/Splunk-Search/set-a-value-at-search-time/m-p/42567#M9954 <P>that exactly what I needed thank you</P> Thu, 22 Nov 2012 09:29:22 GMT https://community.splunk.com/t5/Splunk-Search/set-a-value-at-search-time/m-p/42567#M9954 sbsbb 2012-11-22T09:29:22Z