Splunk Search

How to use "setfields" command to assign the value based on field value rather than field name?

sirching
Loves-to-Learn Lots

I want to use the setfields command to set fieldA to a particular value.  That value is located in fieldB.  How can I make setfields take the value of the field rather then the field name.  setfields fieldA=fieldB sets A to the string "fieldB".

 

Thanks.

Labels (2)
0 Karma

soutamo
SplunkTrust
SplunkTrust

Hi

I think that eval is better on this case.

eval fieldA = fieldB 

is enough to copy fieldB values to fieldA.

r. Ismo

0 Karma

sirching
Loves-to-Learn Lots

My FieldA contains a mixture of 2 values, OSType and Null, total count is 587.  My Field B contains 1 value OSType and has a count of 4.   

 

I am trying to set the 587 count of FieldA values to value of the OSType.   Based on this scenario, what do you suggest.  In the end I want all 587 FieldA values to equal the OSType, thus eliminating the Null value.

 

Thanks

0 Karma

bowesmana
Champion

Can you post an example of your data. From your description I take it that you want to set fieldA=fieldB where fieldA is null. So, you could do

| eval fieldA=coalesce(fieldA, fieldB)

which will copy fieldB to field A when field A is null.

 

0 Karma

soutamo
SplunkTrust
SplunkTrust

Hi

| makeresults
| eval FieldA=split("OStype,,OStype,OStype,,OStype",",")
| mvexpand FieldA
| eval FieldA=nullif(FieldA,"")
| eval FieldB="OStype"
| rename COMMENT as "FieldA are OStype,OStypes and NULL"
| eval FieldA =  FieldB
0 Karma

to4kawa
SplunkTrust
SplunkTrust
| makeresults
| eval FieldA=split("OStype,,OStypes,OStype,,OStype",",")
| mvexpand FieldA
| eval FieldA=nullif(FieldA,"")
| eval FieldB="OStype"
| rename COMMENT as "FieldA are OStype,OStypes and NULL"
| eventstats count(eval(FieldA=FieldB)) as count

stats() eventstats() and chart() can use eval.

0 Karma