Splunk Search

Setting field value based on another field

tsheets13
Communicator

I have a value in my events called type, which is a single digit integer (1, 2, 3, etc.)

I would like to create a new string field in my search based on that value.

So, something like this pseudocode...

if type = 1 then desc = "pre"
if type = 2 then desc = "current"
if type = 3 then desc = "post"

I realize the splunk doesn't do if/then statements but I thought that was the easiest way to explain.

Thanks

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @tsheets13,
you have to use eval command with case option:

| eval desc=case(type="1","pre",type="2","current",type="3","post")

for more infos see at https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/ConditionalFunctions

Ciao.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @tsheets13,
you have to use eval command with case option:

| eval desc=case(type="1","pre",type="2","current",type="3","post")

for more infos see at https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/ConditionalFunctions

Ciao.
Giuseppe

tsheets13
Communicator

Perfect! Thank you

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...