Splunk Search

How to run an eval command if a statment is true, and keep non true data in the search?

robertlynch2020
Influencer

Hi

Below is a simple example of what I am trying to do.

I am trying to remove the duplicate out of the process name. So I have the code for that but only run this code if service_type = agent-based. 

So ideal I want to run an If service_type = agent-based then eval below.

However I lose the !=agent-based. that I don't want to run the eval on that. 

so how to I say if agent-based run these 2 evals on that specific data and then keep the rest of the !=agent-based

 

 

 

| eval temp=split($Process_Name$," ") 
    | eval Process_Name=mvindex(temp,0)

 

 

 

robertlynch2020_1-1631191701585.png

Thanks in Advance

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval Process_Name=if(service_type="agent-based",mvindex(split($Process_Name$," "),0),$Process_Name$)
0 Karma

robertlynch2020
Influencer

Hi 

Thanks, that is perfect. 

Thanks

Rob

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...