How can I assign a field value to a variable using eval?

[mjlsnombrado]

I want to assign a specific field value to a variable I want to do something like this:

|eval output = ('Fieldname'=fieldvalue)

[smoir_splunk]

Depending on your use case, coalesce might also do what you need: https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/ConditionalFunctions#coalesce.28X...

[493669]

Try this:

...| eval splitted=split(Field, "and")|eval output =mvindex(splitted,1)

Try this run anywhere search:

|makeresults|eval Field="A and  B"| eval splitted=split(Field, "and")|eval output =mvindex(splitted,1)

[MuS]

Hi mjlsnombrado,

If I understand your question correct, you can do this:

.... | eval output=fieldname

But if you actually want to use a value of a field as new field name, you can do this:

.... | eval foo="bar", someother_field="baz", {foo}=someother_field

this will create a kv like this bar="baz".

Hope this helps ...

cheers, MuS

[mjlsnombrado]

Thanks 🙂 , but what I want is to set a field value to a variable, for example "fieldname" contains "A" and "B", I want to create a new field named "output" and it will contain "B" (output= B)

[493669]

@mjlsnombrado how does fieldname value is ? is it fieldname= "A B" or "A and B"

[mjlsnombrado]

It is "A and B "