How to evaluate multiple fields and replace field output with new string

[garciajbg]

I have an issue where events are displaying incorrect information for a particular field in my search.

Example:

mySearch | table field 1, field 2, field 3, field 4, field 5, field 6, field 7

My problem is fields 4, 6, and 7 somewhat correspond with one another.

field 5 = errorCode
field 6 = errorMessage
field 7 = output string

If "field 5" = success ----------then "field 6" is null----------- and "field 7" shows the correct output string
HOWEVER
If "field 5" = an error code------- then "field 6" will show the error message-------BUT "field 7" shows the incorrect output string

What I am trying to do is evaluate "field 5", and if "Field 5" equals anything other than "success" string then "field 7" will equal a new string of my choice. If "field 5" equals "success" than leave "field 7" alone.

[richgalloway · Accepted solution]

Here's one way to do that.

... | eval field7 = if(field5="success", field7, "string of my choice")

[garciajbg]

richgalloway,

So I was able to correct any issues by first renaming field 7 to something simple with no periods, spaces, etc. Once I did that and ran the search with the eval it worked as I wanted it to. Thanks!

[garciajbg]

Richagalloway,

I’ve tried this already but I can’t seem to get field 7 to show its default string. In the example given field 7 would show the name of field 7 rather than its original string if the search was run without the eval.

For example, ran WITHOUT “eval” listed above.
Field 5 Field 6 Field 7
Success null success
Error ErrroMSG success

Where field 5 shows the incorrect field 7 string

For example WITH “eval” listed above
Field 5 Field 6 Field 7
Success null Field 7
Error ErrorMSG MyString

[richgalloway]

Please share your query.