Splunk Search

How to replace the value of field for another field value if a certain condition is met?

hcannon
Path Finder

I feel like this should be easily done with eval, but it doesn't seem to be working for me!

I have data sets that include lines like this:

1.  hostname=Unknown mac=4403a7c31cc0
2.  hostname=xxx.yyy.com mac=fc99478bf09d
3.  hostname=Unknown mac=689ce2cc3100

In every instance where hostname=Unknown, I want to substitute the value of the mac field for the host name. So, lines 1 and 3 above would have the value of the the mac field instead of "Unknown" as the hostname value. I'm using the below search, but it's replacing every single instance of the hostname with the mac, instead of applying the condition hostname=Unknown -- ideas on where I'm going wrong?

... | eval hostname=if(hostname=="Unknown",mac,hostname)
0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

 ... | eval hostname=if(match(hostname, "^Unknown$"), mac, hostname)

View solution in original post

woodcock
Esteemed Legend

Try this:

 ... | eval hostname=if(match(hostname, "^Unknown$"), mac, hostname)

ppablo
Retired

Hi @hcannon

I noticed you upvoted the comment by @bchung_splunk. Did that answer your question? Can you provide more details or confirm in a comment please so we know if your issue is resolved or not?

0 Karma

bchung_splunk
Splunk Employee
Splunk Employee

I ran your eval, and got correct results:

hostname    mac
689ce2cc3100    689ce2cc3100
xxx.yyy.com fc99478bf09d
4403a7c31cc0    4403a7c31cc0

search string:

source=*t.log | eval hostname=if(hostname=="Unknown",mac,hostname) | table hostname mac

what's version of splunk you're running on?

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...