Eval and match create a new field

[Splunk_rocks]

I have fields like Uid and Case If the case is authentication then then my new field has to show Uid number.

Case. uid

authentication 12r345567

signoff z234567
signoff rt34567
authentication 34r56789
authentication 24r56789

Im just trying to write eval statement like eval New_UId = if(match(case=authentication "uid", "None" )

but could not make it so just posting here ..

[493669 · Accepted solution]

try this run anywhere search:

| makeresults |eval uid=1, case1="authentication"|eval New_UId = if(case1=="authentication" ,uid, "None" )

[Splunk_rocks]

Thanks bud it worked ..

[mdsnmss]

You should be able to create a calculated field that is just if(case=authentication,uid,"None")

[Splunk_rocks]

Thank you mdsnmss