Want to replace the field value name

[ramkyreddy]

Name

sku

kit

NAC-D-CDSK-DLS-05.90

NAC-D

HJA-JEOE-DNDN-94.4.0

This my data, I want to replace  with NAC-D to ANT-P for multiple values
this is my search query

| eval sku = if(name=="",substr(kit,0,5),substr(name,0,5))
| eval sku=case(sku =="NAC-D","ANT-P ",sku =="DHV-K","ABD-U",true(),sku)

[ramkyreddy]

thanks,  I got expected  output

[gcusello]

Hi @ramkyreddy ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello]

Hi @ramkyreddy,

what exactly is your requirement?

<your_search>
| eval sku = if(name="",substr(kit,0,5),substr(name,0,5))
| eval sku=case(sku="NAC-D","ANT-P",sku="DHV-K","ABD-U",true(),sku)

the search should work.

 Ciao.

giuseppe