I am trying to create a new extracted field by using existing calculated field. The reason I want to do this is because I came to know that a calculated field can't be used to create another calculated field.
Example of what I am trying to achieve:
Combining values of 2 fields and assigning it to "fielda":
`eval fielda=case(valueoffield=="a",valueoffieldx . "" . valueoffield_y)`
Use values of "fielda" and determine value of "fieldb"
I can use this in search line just fine because I can have multiple eval statements in splunk search but I want to define brand new public fields with these same evals and I can't do multiple evals while creating a new public calculated field.
Is there any workaround to achieve #2 above?? i.e. can I create another regex field that uses the same values of "fielda" and use extracted field to create calculated "fieldb"?