I have the data format below, and I would like to filldown with specific field value base on command Field1.
i.e. Fill Field2 with character 'B' if Field1 is 'A'
Fill Filed2 with character 'C' if Field1 is 'B'
Data:
Field1 | Field2 | Field3 | Field4 |
A | fooA | barB | |
A | abc | def | |
A | B | ghi | jkl |
B | C | fooB | barC |
B | aaa | bbb | |
B | ccc | ddd |
Change to below format
Field1 | Field2 | Field3 | Field4 |
A | B | fooA | barB |
A | B | abc | def |
A | B | ghi | jkl |
B | C | fooB | barC |
B | C | aaa | bbb |
B | C | ccc | ddd |
| eventstats values(Field2) as Field2 by Field1
hi @Raymond2T
Can you plese try this
| eval Field2=if(Field1="A","B",if(Field1="B","C",Field2))
Thanks for the quick reply.
If I could not hardcode the value , All fields value are search result.
How could I accomplish it ?
Really appreciate for your help.