Splunk Search

How to change values in a column based on a value in a different column in the same row?

mprreddy51
Explorer

Hi,

I have a requirement:

My table data shows like this:

ACCNO    STATUS    TYPE    CODE
123       A        GOL     TECH
456       A        SIL     TECH
199       A        GRR     TECH
789       A        GOL     TECH
143       A        0       TECH
543       A        0       TECH 

Expected output:

ACCNO    STATUS    TYPE   CODE
123       A        GOL    TECH
456       A        SIL    TECH
199       A        GRR    TECH
789       A        GOL    TECH
143       A        0      0
543       A        0      0

I want to display the value as " 0" in CODE wherever TYPE value is 0.

Thanks In advance.

-PR

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this

... | eval CODE=if(TYPE=0,0,CODE) | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...