Splunk Search

How to update my case statement to preserve original field contents

Path Finder

Hello Splunk experts,

Not sure if I'm going about this the right way, but I'd like to store contents of multiple fields in 1 field using an eval statement. I will be testing one of the fields against a specific string and the two other fields (json) I'd like to just store the current values if the they aren't null. Meaning I just want them to be added to the analysis_proposal field. Again, not sure if case is the best way to achieve this but any help would be really appreciated.

| eval analysis_proposal =
    case(
             isnotnull(field1) and field1=="my field 1 test.", "legacy",
             isnotnull(field10.contents), field10.contents,
             isnotnull(field20.contents{}), field20.contents{})
Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

The case command would only execute expression where the condition is matched. If you want to process all three conditions, try this:

...| eval analysis_proposal=if(  isnotnull(field1) and field1=="my field 1 test.", analysis_proposal."legacy", analysis_proposal)
| eval analysis_proposal=if(  isnotnull(field10.contents) , analysis_proposal.'field10.contents' , analysis_proposal)
| eval analysis_proposal=if(  isnotnull(field20.contents) , analysis_proposal.'field20.contents', analysis_proposal)

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

The case command would only execute expression where the condition is matched. If you want to process all three conditions, try this:

...| eval analysis_proposal=if(  isnotnull(field1) and field1=="my field 1 test.", analysis_proposal."legacy", analysis_proposal)
| eval analysis_proposal=if(  isnotnull(field10.contents) , analysis_proposal.'field10.contents' , analysis_proposal)
| eval analysis_proposal=if(  isnotnull(field20.contents) , analysis_proposal.'field20.contents', analysis_proposal)

View solution in original post

0 Karma