How to fetch value of column in Splunk table?

[ktanwar]

Hi all,

So lets suppose I have the following table:

Job_ID  Parameter_A  Parameter_B

1                   "Car"                     "Red"

2                    "Bus"                    "Blue"

I want to get value "Red" and use it in an eval function. How to do it? Thanks!

@bowesmana calling you for help like always!!!

[bowesmana]

In that table, it looks like you have two rows, each with 3 fields. The field 'Parameter_B' contains the value "Red" for row 1, so as @richgalloway says, you just use Parameter_B field in the eval statement.

[richgalloway]

Field values are always referenced by the field name, "Parameter_B" in this case.  By saying | eval foo=Parameter_B you give the 'foo' field the value "Red" or "Blue".   To only set foo to "Red", use a conditional.

| eval foo=if(Parameter_B="Red", Parameter_B, null())