Splunk Search

How to replace specific field value?

kdimaria
Communicator

I am trying to replace a specific field. I have a table that is like:

Name Street Zip Note
John Wall 123 hello
.
.
.
So I am basically trying to change the Note column. I was doing like:
eval Note="changed note" WHERE Name="John"
to grab that specific note column and not change all of them but when I try to run that it does not work.

0 Karma
1 Solution

cmerriman
Super Champion

so you're trying to change the value of the Note column when Name=John?
does this work:

|eval Note=if(Name="John","changed note",Note)

View solution in original post

cmerriman
Super Champion

so you're trying to change the value of the Note column when Name=John?
does this work:

|eval Note=if(Name="John","changed note",Note)

cblanton
Communicator

I'm trying to do this exact same thing but my search doesn't seem to recognize when, for example Name="John." It sets the Z value to Note, regardless. I've tried changing the Z value and that changes, but when the X matches, it doesn't return Y, only Z. So it is returning Z and not just not doing the eval all together.

| eval MedRepoCloneMergeTime=if(Event="mock", "NA", MedRepoCloneMergeTime)

When X doesn't match, it also returns Z.

0 Karma

cmerriman
Super Champion

Have you checked that the fields are spelled correctly and capitalized properly and the field value is also correctly spelled/capped? I know it’s silly but it’s critical. The fields and values need to exist and need to be exact. Do you have example data?

0 Karma

kdimaria
Communicator

Yes that works thank you 🙂

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...