How to write an eval condition to replace a field ?

[pavanae]

I have a query which displays some tabular results and when a certain condition is matched for 2 field values I want to insert a new value to Field_A like below

If fieldA="not registered" and fieldB="PROVISIONING" for a list of hosts then I want to change the Field_A value from "not registered" to "registered but not monitored"

How can I write an eval condition to satisfy the above. I have some how managed to get a little further like below

| eval fieldA=if(fieldA=="not registered" AND field_B=="PROVISIONING")

Please complete the above part eval condition above if someone knows how to do it?

[somesoni2 · Accepted solution]

How about this?

| eval field_A=if(field_A=="not registered" AND field_B=="PROVISIONING", "regiestred but not monitored", field_A)

[aalaa]

hello , Please how can i create a condition in a search to replace an event with a name , even if this event does not exist at the moment