How to edit my Eval search so that if "field=null", do nothing and if "field=not null", replace value?

[ltrand]

So I'm trying to build an asset table, and update fields based on select criteria. What I'm getting stuck on is I want nothing to happen if there isn't a match, but I want an action if there is a match.

For example, I have a table as follows:
asset_lookup: fields: ip,dns,bunit, category,priority

I have another that is as follows:
hva_asset_lookup: fields: host, system_group

So the asset_lookup, when generated, sets the priority to "medium". I want to override that if there is a match on the hva_asset_lookup, so I do the following search:

| inputlookup asset_lookup 
| lookup hva_assets host AS ip OUTPUT system_group
| eval priority=if(isnull(FISMA_system_name),"medium","critical")

This works, but I'd rather get rid of the "null" action so that I could chain together the logic and continue to change the priority without overriding the prior settings. For example, if I follow that up with this:

| eval priority=case(bunit="hq","high")

Everything that doesn't match is overridden to null. And if I do it prior to the if(isnull()) eval, then the high is overridden. So, how do I override a field only if my eval matches, and to not touch is otherwise?

[DalJeanis]

The case statement is the issue. if bunit is not "hq", then the entire statement returns no value.

somesoni2's code snippets are correct (either is equivalent).

[somesoni2 · Accepted solution]

How about this. If your condition matches, it'll overwrite the the value of priority to high, in all other cases, will keep the same value (what existed before this command).

 | eval priority=case(bunit="hq","high",true(),priority)

or

 | eval priority=if(bunit="hq","high",priority)

[DalJeanis]

suggestion - somesoni2 - you should move this comment to an answer so that ltrand can accept it.

[ltrand]

Awesome, thanks! I didn't even think about passing the value back in!