Two fields (same value), fill in third field

[rocarril]

My dataset has three fields from two different data sources. Two fields are identical (hostnames with different field names). One dataset has a third field that I would like to fill in. Example:

sourcetype . hostname1 computer1 . domain
source1 . host1 . NT1
source1 . host2 NT2
source2 host1
source2 host2

Want to it to be:

sourcetype . hostname1 computer1 . domain
source1 . host1 . host1 NT1
source1 . host2 host2 NT2
source2 host1 host1 NT1
source2 host2 host2 . NT2

[Kwip]

| eval Domain=case(
hostname1="host1" AND computername1="host1", "NT1",
hostname1="host2" AND computername1="host2", "NT2")

Same can achieve via lookup if you have large no of values to be created.

[micahkemp]

How are the values NT1 and NT2 determined for the last two events in your example output?