Splunk Search

How to write an eval condition to replace a field ?

pavanae
Builder

I have a query which displays some tabular results and when a certain condition is matched for 2 field values I want to insert a new value to Field_A like below

If field_A="not registered" and field_B="PROVISIONING" for a list of hosts then I want to change the Field_A value from "not registered" to "registered but not monitored"

How can I write an eval condition to satisfy the above. I have some how managed to get a little further like below

| eval field_A=if(field_A=="not registered" AND field_B=="PROVISIONING")

Please complete the above part eval condition above if someone knows how to do it?

0 Karma
1 Solution

somesoni2
Revered Legend

How about this?

| eval field_A=if(field_A=="not registered" AND field_B=="PROVISIONING", "regiestred but not monitored", field_A)

View solution in original post

aalaa
Path Finder

hello , Please how can i create a condition in a search to replace an event with a name , even if this event does not exist at the moment

0 Karma

somesoni2
Revered Legend

How about this?

| eval field_A=if(field_A=="not registered" AND field_B=="PROVISIONING", "regiestred but not monitored", field_A)
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...