How can I replace that field values to another and vice versa?

[saivardhan]

For example, my account number is coming as device number and vice versa and that is expected based on the condition I have in my search. But if I meet another condition, I would like to swap back the values.

| eval statsType = if ((like(name, "other"), | streamstats current=t values(device) as account, values(account) as device))

Device and account are the fields I would like to swap values.

Thanks in advance.

[somesoni2]

About query is super confusing. If all three fields (device, account and name) are on the same row and you want to manipulate them based on value on current row only, you could do like this

your current search
| eval temp1=device | eval temp2=account 
| eval device=if(like(name,"other"), temp2,temp1)
| eval account=if(like(name,"other"), temp1,temp2) 
| fields - temp1 temp2