Splunk Search

How to change values in a column based on a value in a different column in the same row?

mprreddy51
Explorer

Hi,

I have a requirement:

My table data shows like this:

ACCNO    STATUS    TYPE    CODE
123       A        GOL     TECH
456       A        SIL     TECH
199       A        GRR     TECH
789       A        GOL     TECH
143       A        0       TECH
543       A        0       TECH 

Expected output:

ACCNO    STATUS    TYPE   CODE
123       A        GOL    TECH
456       A        SIL    TECH
199       A        GRR    TECH
789       A        GOL    TECH
143       A        0      0
543       A        0      0

I want to display the value as " 0" in CODE wherever TYPE value is 0.

Thanks In advance.

-PR

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this

... | eval CODE=if(TYPE=0,0,CODE) | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...