Splunk Search

How can I replace that field values to another and vice versa?

saivardhan
New Member

For example, my account number is coming as device number and vice versa and that is expected based on the condition I have in my search. But if I meet another condition, I would like to swap back the values.

| eval statsType = if ((like(name, "other"), | streamstats current=t values(device) as account, values(account) as device))

Device and account are the fields I would like to swap values.

Thanks in advance.

0 Karma

somesoni2
Revered Legend

About query is super confusing. If all three fields (device, account and name) are on the same row and you want to manipulate them based on value on current row only, you could do like this

your current search
| eval temp1=device | eval temp2=account 
| eval device=if(like(name,"other"), temp2,temp1)
| eval account=if(like(name,"other"), temp1,temp2) 
| fields - temp1 temp2
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...