How to Set field to value of another with a where clause?

[jpfrancetic]

Hi Splunk Community,

I am trying to work with over writing fields using an if clause. The data I have is like what is in the table below:

Sourcetype	Index	LastSeenDate
clarity-A	abc123	2-6-2023
clarity-B	abc123	1-15-2023
clarity-C	abc123	12-1-2022
DR:101:405	abc123	2-4-2023
BillingTool	abc123	2-2-2023

I want to overwrite the current LastSeenDates only for clarity-B and clarity-C so that their last seen date is equal to the LastSeenDate for clarity-A. The table below is an example of what I am trying to achieve:

Sourcetype	Index	LastSeenDate
clarity-A	abc123	2-6-2023
clarity-B	abc123	2-6-2023
clarity-C	abc123	2-6-2023
DR:101:405	abc123	2-4-2023
BillingTool	abc123	2-2-2023

[ITWhisperer]

Assuming your sourcetypes follow the pattern shown and your events are in time order, try something like this

| eval commonSourceType=mvindex(split(Sourcetype,"-"),0)
| eventstats latest(LastSeenDate) as LastSeenDate by commonSourceType