Archive

IF then problems...

Path Finder

struggling with the following IF statement....

I have a table, and want to create a new field called 'finalclosedtime' which will be populated either by an existing field called 'closedtime' or a string IF one of the other fields contains a value of "New".

I tried this but no joy:

| eval finalclosedtime=if((status_label="New",stringtopopulate)closedtime)

Any ideas? Thanks.

Tags (1)
0 Karma
1 Solution

Builder

You can form the field this way -

| eval finalclosedtime=if(like(status_label,"%New%"),stringtopopulate,closedtime)

View solution in original post

Communicator

Hi There, try it simply as:

| eval finalclosedtime=if(status_label="New", stringtopopulate, closedtime)

Path Finder

Also worked, thanks!

0 Karma

Builder

You can form the field this way -

| eval finalclosedtime=if(like(status_label,"%New%"),stringtopopulate,closedtime)

View solution in original post

Path Finder

Thats so simple, took me ages trying to get that working! many thanks!

0 Karma

SplunkTrust
SplunkTrust

Great! Please accept the answer that solved the problem, and upvote any other answers that you found particularly helpful.

0 Karma

Builder

no problem 🙂

0 Karma