- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to filldown with specific field value
Raymond2T
Path Finder
02-27-2022
08:25 PM
I have the data format below, and I would like to filldown with specific field value base on command Field1.
i.e. Fill Field2 with character 'B' if Field1 is 'A'
Fill Filed2 with character 'C' if Field1 is 'B'
Data:
Field1 | Field2 | Field3 | Field4 |
A | fooA | barB | |
A | abc | def | |
A | B | ghi | jkl |
B | C | fooB | barC |
B | aaa | bbb | |
B | ccc | ddd |
Change to below format
Field1 | Field2 | Field3 | Field4 |
A | B | fooA | barB |
A | B | abc | def |
A | B | ghi | jkl |
B | C | fooB | barC |
B | C | aaa | bbb |
B | C | ccc | ddd |
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
02-28-2022
01:42 AM
| eventstats values(Field2) as Field2 by Field1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
SanjayReddy

SplunkTrust
02-27-2022
09:01 PM
hi @Raymond2T
Can you plese try this
| eval Field2=if(Field1="A","B",if(Field1="B","C",Field2))
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Raymond2T
Path Finder
02-27-2022
09:32 PM
Thanks for the quick reply.
If I could not hardcode the value , All fields value are search result.
How could I accomplish it ?
Really appreciate for your help.
