Splunk Search

How to use "setfields" command to assign the value based on field value rather than field name?

sirching
Loves-to-Learn Lots

I want to use the setfields command to set fieldA to a particular value.  That value is located in fieldB.  How can I make setfields take the value of the field rather then the field name.  setfields fieldA=fieldB sets A to the string "fieldB".

 

Thanks.

Labels (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

I think that eval is better on this case.

eval fieldA = fieldB 

is enough to copy fieldB values to fieldA.

r. Ismo

0 Karma

sirching
Loves-to-Learn Lots

My FieldA contains a mixture of 2 values, OSType and Null, total count is 587.  My Field B contains 1 value OSType and has a count of 4.   

 

I am trying to set the 587 count of FieldA values to value of the OSType.   Based on this scenario, what do you suggest.  In the end I want all 587 FieldA values to equal the OSType, thus eliminating the Null value.

 

Thanks

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Can you post an example of your data. From your description I take it that you want to set fieldA=fieldB where fieldA is null. So, you could do

| eval fieldA=coalesce(fieldA, fieldB)

which will copy fieldB to field A when field A is null.

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

| makeresults
| eval FieldA=split("OStype,,OStype,OStype,,OStype",",")
| mvexpand FieldA
| eval FieldA=nullif(FieldA,"")
| eval FieldB="OStype"
| rename COMMENT as "FieldA are OStype,OStypes and NULL"
| eval FieldA =  FieldB
0 Karma

to4kawa
Ultra Champion
| makeresults
| eval FieldA=split("OStype,,OStypes,OStype,,OStype",",")
| mvexpand FieldA
| eval FieldA=nullif(FieldA,"")
| eval FieldB="OStype"
| rename COMMENT as "FieldA are OStype,OStypes and NULL"
| eventstats count(eval(FieldA=FieldB)) as count

stats() eventstats() and chart() can use eval.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...