Splunk Search

How can I replace that field values to another and vice versa?

saivardhan
New Member

For example, my account number is coming as device number and vice versa and that is expected based on the condition I have in my search. But if I meet another condition, I would like to swap back the values.

| eval statsType = if ((like(name, "other"), | streamstats current=t values(device) as account, values(account) as device))

Device and account are the fields I would like to swap values.

Thanks in advance.

0 Karma

somesoni2
Revered Legend

About query is super confusing. If all three fields (device, account and name) are on the same row and you want to manipulate them based on value on current row only, you could do like this

your current search
| eval temp1=device | eval temp2=account 
| eval device=if(like(name,"other"), temp2,temp1)
| eval account=if(like(name,"other"), temp1,temp2) 
| fields - temp1 temp2
0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...