Splunk Search

Run the condition on multiple fields of each events

khojas02
Engager

I have set of events as below:

EmployeeID Company
C123 ABC
C456 DEF
C789
2598
3648

Here, all the EmployeeID starting with C are Contractors and some of them have Company values. Now I want to achieve 2 things
1. I want to Populate "Unknown" where the EmployeeID starts with C but there is no Company value.
2. And for all the other EmployeeID (not starting with C), I want to populate Fulltime.

Thanks in advance!!

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This should help.

... | eval Company = case(isnotnull(Company), Company, match(EmployeeID, "C.*"), "Unknown", 1==1, "Fulltime")
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should help.

... | eval Company = case(isnotnull(Company), Company, match(EmployeeID, "C.*"), "Unknown", 1==1, "Fulltime")
---
If this reply helps you, Karma would be appreciated.
0 Karma

khojas02
Engager

Thanks a lot, it worked for me.

I was trying to implement nested loop but it was giving me an error about malformed function or repeatable action. Thanking again for help!!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...