How to Rename event in a field

[woodlandrelic]

Hi 

Am trying to change the "Cloud Service Provider (CSP)"  to "CSP". The field name is "Registration Type"

Screenshot (8).png

Thanks

[ITWhisperer]

| eval "Registration Type"=if('Registration Type'=="Cloud Service Provider (CSP)","CSP",'Registration Type')

[woodlandrelic]

@ITWhisperer  Thanks but am getting an error msg. It seems am missing something.Screenshot (11).pngScreenshot (9).png

[ITWhisperer]

The if function has only 3 parameters, the comparison, the result if true, and the result if false. You could split what you have over a number of eval commands, comparing the field to the different strings you want to change, or you can replace the if function with a case function.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions 

[woodlandrelic · Accepted solution]

Thank you so much it worked. This was the result much appreciated.

| eval "Registration Type"=if('Registration Type'=="Cloud Service Provider (CSP)","CSP",'Registration Type')
| eval "Registration Type"=if('Registration Type'=="Assess Only","AO",'Registration Type')
| eval "Registration Type"=if('Registration Type'=="Assess and Authorize","AA",'Registration Type')