Splunk Search

How can I change the field values to another value ?

dbrancaglion
Explorer

Hello Guys!

I need to change the values that are present in the field "Item Codigo" .
alt text

For example:

040500603S007C10 to Product 01
010300404S014C01 to Product 02

I had searching the method, i tried use eval, but no success...

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are a couple of ways to do that. One is with eval.

... | eval "Item Codigo"  = case ("Item Codigo"=="040500603S007C10" , "Product 01", "Item Codigo"=="010300404S014C01", "Product 02", 1==1, 'Item Codigo')

The other is with a lookup table. First, create a CSV file (I call it "items.csv") with your item numbers and names. Like this:

ItemCodigo, ItemName
040500603S007C10, Product 01
010300404S014C01, Product 02

Then reference the lookup file in your query.

... | lookup items.csv ItemCodigo as "Item Codigo" | eval "Item Codigo" = ItemName
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...