How to calculate field to replace value of field?

[jason_hotchkiss]

Hello - 

I have a table with the following:

host

HOST	FQDN	DNS_NAME	HOST_MATCH	INDEX
hostalpha	hosta.mydomain.com	hosta	false	index_a
hosta	host	-	true	index_b

Created from the following search:

base_search
| rex field=FQDN ""^(?<DNS_NAME>[^.]+)\..*$"
| fillnull value="-" DNS_NAME
|eval HOST_MATCH="if(host='DNS_NAME',"true","false")

How would I replace the do the following:

1.  If HOST != DNS_NAME, Make HOST = DNS_NAME
2.  If DNS_NAME = "-" MAKE DNS_NAME = HOST

Thanks!

[ITWhisperer · Accepted solution]

Just do the evaluations in the opposite order

| eval DNS_NAME=if(DNS_NAME == "-", HOST, DNS_NAME)
| eval HOST=if(HOST != DNS_NAME, DNS_NAME, HOST)

[jason_hotchkiss]

@ITWhisperer thank you.  I was way overthinking this.  Much appreicated!