Splunk Search

How to change values in a column based on a value in a different column in the same row?

mprreddy51
Explorer

Hi,

I have a requirement:

My table data shows like this:

ACCNO    STATUS    TYPE    CODE
123       A        GOL     TECH
456       A        SIL     TECH
199       A        GRR     TECH
789       A        GOL     TECH
143       A        0       TECH
543       A        0       TECH 

Expected output:

ACCNO    STATUS    TYPE   CODE
123       A        GOL    TECH
456       A        SIL    TECH
199       A        GRR    TECH
789       A        GOL    TECH
143       A        0      0
543       A        0      0

I want to display the value as " 0" in CODE wherever TYPE value is 0.

Thanks In advance.

-PR

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this

... | eval CODE=if(TYPE=0,0,CODE) | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...

Index This | How many sevens are there between 1 and 100?

August 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...