Splunk Search

How to use substr in an eval with if

phamxuantung
Communicator

I try to use the query

 

eval ID = if(ORG="MC",ID=substr(ID,-6),0)

 

Basically, I want in my result, if ORG="MC", I want to extract the last 6 characters of the field ID that go with it, otherwise stay the same. But the result table always show ID as False if ORG="MC"

How do I fix my query or have to go the other way?

Labels (2)
0 Karma

manjunathmeti
Champion

hi @phamxuantung,

Fixed the query:

| eval ID=if(ORG="MC", substr(ID, -6), ID)

 

0 Karma
Get Updates on the Splunk Community!

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...