Splunk Search

How to replace specific field value?

kdimaria
Communicator

I am trying to replace a specific field. I have a table that is like:

Name Street Zip Note
John Wall 123 hello
.
.
.
So I am basically trying to change the Note column. I was doing like:
eval Note="changed note" WHERE Name="John"
to grab that specific note column and not change all of them but when I try to run that it does not work.

0 Karma
1 Solution

cmerriman
Super Champion

so you're trying to change the value of the Note column when Name=John?
does this work:

|eval Note=if(Name="John","changed note",Note)

View solution in original post

cmerriman
Super Champion

so you're trying to change the value of the Note column when Name=John?
does this work:

|eval Note=if(Name="John","changed note",Note)

cblanton
Communicator

I'm trying to do this exact same thing but my search doesn't seem to recognize when, for example Name="John." It sets the Z value to Note, regardless. I've tried changing the Z value and that changes, but when the X matches, it doesn't return Y, only Z. So it is returning Z and not just not doing the eval all together.

| eval MedRepoCloneMergeTime=if(Event="mock", "NA", MedRepoCloneMergeTime)

When X doesn't match, it also returns Z.

0 Karma

cmerriman
Super Champion

Have you checked that the fields are spelled correctly and capitalized properly and the field value is also correctly spelled/capped? I know it’s silly but it’s critical. The fields and values need to exist and need to be exact. Do you have example data?

0 Karma

kdimaria
Communicator

Yes that works thank you 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...