Splunk Search

How to change values in a column based on a value in a different column in the same row?

mprreddy51
Explorer

Hi,

I have a requirement:

My table data shows like this:

ACCNO    STATUS    TYPE    CODE
123       A        GOL     TECH
456       A        SIL     TECH
199       A        GRR     TECH
789       A        GOL     TECH
143       A        0       TECH
543       A        0       TECH 

Expected output:

ACCNO    STATUS    TYPE   CODE
123       A        GOL    TECH
456       A        SIL    TECH
199       A        GRR    TECH
789       A        GOL    TECH
143       A        0      0
543       A        0      0

I want to display the value as " 0" in CODE wherever TYPE value is 0.

Thanks In advance.

-PR

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this

... | eval CODE=if(TYPE=0,0,CODE) | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...