Splunk Search

How to use "setfields" command to assign the value based on field value rather than field name?

sirching
Loves-to-Learn Lots

I want to use the setfields command to set fieldA to a particular value.  That value is located in fieldB.  How can I make setfields take the value of the field rather then the field name.  setfields fieldA=fieldB sets A to the string "fieldB".

 

Thanks.

Labels (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

I think that eval is better on this case.

eval fieldA = fieldB 

is enough to copy fieldB values to fieldA.

r. Ismo

0 Karma

sirching
Loves-to-Learn Lots

My FieldA contains a mixture of 2 values, OSType and Null, total count is 587.  My Field B contains 1 value OSType and has a count of 4.   

 

I am trying to set the 587 count of FieldA values to value of the OSType.   Based on this scenario, what do you suggest.  In the end I want all 587 FieldA values to equal the OSType, thus eliminating the Null value.

 

Thanks

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Can you post an example of your data. From your description I take it that you want to set fieldA=fieldB where fieldA is null. So, you could do

| eval fieldA=coalesce(fieldA, fieldB)

which will copy fieldB to field A when field A is null.

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

| makeresults
| eval FieldA=split("OStype,,OStype,OStype,,OStype",",")
| mvexpand FieldA
| eval FieldA=nullif(FieldA,"")
| eval FieldB="OStype"
| rename COMMENT as "FieldA are OStype,OStypes and NULL"
| eval FieldA =  FieldB
0 Karma

to4kawa
Ultra Champion
| makeresults
| eval FieldA=split("OStype,,OStypes,OStype,,OStype",",")
| mvexpand FieldA
| eval FieldA=nullif(FieldA,"")
| eval FieldB="OStype"
| rename COMMENT as "FieldA are OStype,OStypes and NULL"
| eventstats count(eval(FieldA=FieldB)) as count

stats() eventstats() and chart() can use eval.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...