Splunk Search

Check to see if value is in a field if not get from next field

MeMilo09
Path Finder

Hello,

How can I check to see if value is in one field first, if not check the next field?

I have so far the below, it works, but I would like to use an if statement to check if team_name is in Blue first and if not then get the team_name from Red.

| eval Team_Color=case(team=“Blue”, team_name OR team=“Red”, team_name)

any advice on how to use if statement instead of case? 

Labels (2)
0 Karma
1 Solution

dave_null
Path Finder

Yeah just nest them:

 

| eval Team_Color=if(<check 1>, <value if check1 true> , if( <check 2> , <value if check2 true>, <value if both false>))

E.g. 

 

| eval Team_Color = if(team="Blue", team_name, if(team="Red",team_name, ""))

View solution in original post

dave_null
Path Finder

Yeah just nest them:

 

| eval Team_Color=if(<check 1>, <value if check1 true> , if( <check 2> , <value if check2 true>, <value if both false>))

E.g. 

 

| eval Team_Color = if(team="Blue", team_name, if(team="Red",team_name, ""))

Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...