Splunk Search

How to use "setfields" command to assign the value based on field value rather than field name?

sirching
Loves-to-Learn Lots

I want to use the setfields command to set fieldA to a particular value.  That value is located in fieldB.  How can I make setfields take the value of the field rather then the field name.  setfields fieldA=fieldB sets A to the string "fieldB".

 

Thanks.

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

I think that eval is better on this case.

eval fieldA = fieldB 

is enough to copy fieldB values to fieldA.

r. Ismo

0 Karma

sirching
Loves-to-Learn Lots

My FieldA contains a mixture of 2 values, OSType and Null, total count is 587.  My Field B contains 1 value OSType and has a count of 4.   

 

I am trying to set the 587 count of FieldA values to value of the OSType.   Based on this scenario, what do you suggest.  In the end I want all 587 FieldA values to equal the OSType, thus eliminating the Null value.

 

Thanks

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Can you post an example of your data. From your description I take it that you want to set fieldA=fieldB where fieldA is null. So, you could do

| eval fieldA=coalesce(fieldA, fieldB)

which will copy fieldB to field A when field A is null.

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

| makeresults
| eval FieldA=split("OStype,,OStype,OStype,,OStype",",")
| mvexpand FieldA
| eval FieldA=nullif(FieldA,"")
| eval FieldB="OStype"
| rename COMMENT as "FieldA are OStype,OStypes and NULL"
| eval FieldA =  FieldB
0 Karma

to4kawa
Ultra Champion
| makeresults
| eval FieldA=split("OStype,,OStypes,OStype,,OStype",",")
| mvexpand FieldA
| eval FieldA=nullif(FieldA,"")
| eval FieldB="OStype"
| rename COMMENT as "FieldA are OStype,OStypes and NULL"
| eventstats count(eval(FieldA=FieldB)) as count

stats() eventstats() and chart() can use eval.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...