Conditional Field Alias (Not in search bar)

shayhibah · ‎09-26-2018

I would like to map to data model and want that specific field to behave like A=B only if C="some value" (A is the new field while B,C are existing fields).

I tried to go to setting and under "Field Aliases" looked for condition but I could not find.

Does someone know how to do it?

Thanks

kamlesh_vaghela · ‎09-26-2018

@shayhibah,

Is it possible to use Calculated fields?

Fields » Calculated fields » Add new

Conditional Field Alias (Not in search bar)

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

[Puzzles] Solve, Learn, Reuse: Word-play

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path

Best Practices: Splunk auto adjust pipeline queue

Join the Conversation

Conditional Field Alias (Not in search bar)

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

[Puzzles] Solve, Learn, Reuse: Word-play

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path

Best Practices: Splunk auto adjust pipeline queue