I have a data in Splunk like
index="main"
Fname | Country |
fname1 | USA |
fname1 | USA |
fname3 | USA |
I want to add and change some data
where Fname="fname1" I want to edit that Country = UK and add field of Phone =123
The final data will be
Fname | Phone | Country |
fname1 | 123 | UK |
fname1 | 123 | UK |
fname3 | USA |
How can I do that?
Hi @jokovitch,
as @anilchaithu hinted, the correct search should be:
index=main
| eval Country=if(Fname="fname1","UK",Country), Phone=if(Fname="fname1","123","")
| table Fname Phone Country
if it doesn't run, check the fieldname (fields are case sensitive).
If doesn't run, please describe results and what's error.
Ciao.
Giuseppe
you can use the below eval command for this task
eval Country = if(Fname="fname1", "UK", Fname), Phone= case(Fname="fname1", "123")
-- Hope this helps
index="main" |eval Phone= case(Fname="fname1", "123")
I have tried this command , but nothing changed
strange, try this.
index="main" | eval Phone= case(like(Fname, "%fname1%", "123")
-- Hope this helps
You need to change
index="main" | eval Phone= case(like(Fname, "%fname1%", "123")
to
index="main" | eval Phone= case(like(Fname, "%fname1%"), "123")
That still not change the data
Do I need to put this query in another place then New Search screen ? Or maybe is there place that I need to mark to commit this data?
Do you have any idea how to fix that ?