How to update my case statement to preserve original field contents

[splunker1981]

Hello Splunk experts,

Not sure if I'm going about this the right way, but I'd like to store contents of multiple fields in 1 field using an eval statement. I will be testing one of the fields against a specific string and the two other fields (json) I'd like to just store the current values if the they aren't null. Meaning I just want them to be added to the analysis_proposal field. Again, not sure if case is the best way to achieve this but any help would be really appreciated.

| eval analysis_proposal =
    case(
             isnotnull(field1) and field1=="my field 1 test.", "legacy",
             isnotnull(field10.contents), field10.contents,
             isnotnull(field20.contents{}), field20.contents{})

[somesoni2 · Accepted solution]

The case command would only execute expression where the condition is matched. If you want to process all three conditions, try this:

...| eval analysis_proposal=if(  isnotnull(field1) and field1=="my field 1 test.", analysis_proposal."legacy", analysis_proposal)
| eval analysis_proposal=if(  isnotnull(field10.contents) , analysis_proposal.'field10.contents' , analysis_proposal)
| eval analysis_proposal=if(  isnotnull(field20.contents) , analysis_proposal.'field20.contents', analysis_proposal)