Splunk Search

IF then problems...

jacqu3sy
Path Finder

struggling with the following IF statement....

I have a table, and want to create a new field called 'finalclosedtime' which will be populated either by an existing field called 'closedtime' or a string IF one of the other fields contains a value of "New".

I tried this but no joy:

| eval finalclosedtime=if((status_label="New",stringtopopulate)closedtime)

Any ideas? Thanks.

Tags (1)
0 Karma
1 Solution

dineshraj9
Builder

You can form the field this way -

| eval finalclosedtime=if(like(status_label,"%New%"),stringtopopulate,closedtime)

View solution in original post

paulbannister
Communicator

Hi There, try it simply as:

| eval finalclosedtime=if(status_label="New", stringtopopulate, closedtime)

jacqu3sy
Path Finder

Also worked, thanks!

0 Karma

dineshraj9
Builder

You can form the field this way -

| eval finalclosedtime=if(like(status_label,"%New%"),stringtopopulate,closedtime)

jacqu3sy
Path Finder

Thats so simple, took me ages trying to get that working! many thanks!

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Great! Please accept the answer that solved the problem, and upvote any other answers that you found particularly helpful.

0 Karma

dineshraj9
Builder

no problem 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...