I want to assign a specific field value to a variable I want to do something like this:
|eval output = ('Fieldname'=fieldvalue)
Depending on your use case, coalesce might also do what you need: https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/ConditionalFunctions#coalesce.28X...
Try this:
...| eval splitted=split(Field, "and")|eval output =mvindex(splitted,1)
Try this run anywhere search:
|makeresults|eval Field="A and B"| eval splitted=split(Field, "and")|eval output =mvindex(splitted,1)
Hi mjlsnombrado,
If I understand your question correct, you can do this:
.... | eval output=fieldname
But if you actually want to use a value of a field as new field name, you can do this:
.... | eval foo="bar", someother_field="baz", {foo}=someother_field
this will create a kv like this bar="baz"
.
Hope this helps ...
cheers, MuS
Thanks 🙂 , but what I want is to set a field value to a variable, for example "fieldname" contains "A" and "B", I want to create a new field named "output" and it will contain "B" (output= B)
@mjlsnombrado how does fieldname value is ? is it fieldname= "A B"
or "A and B"
It is "A and B "