Hello Splunk experts,
Not sure if I'm going about this the right way, but I'd like to store contents of multiple fields in 1 field using an eval statement. I will be testing one of the fields against a specific string and the two other fields (json) I'd like to just store the current values if the they aren't null. Meaning I just want them to be added to the analysis_proposal field. Again, not sure if case is the best way to achieve this but any help would be really appreciated.
| eval analysis_proposal =
case(
isnotnull(field1) and field1=="my field 1 test.", "legacy",
isnotnull(field10.contents), field10.contents,
isnotnull(field20.contents{}), field20.contents{})
The case command would only execute expression where the condition is matched. If you want to process all three conditions, try this:
...| eval analysis_proposal=if( isnotnull(field1) and field1=="my field 1 test.", analysis_proposal."legacy", analysis_proposal)
| eval analysis_proposal=if( isnotnull(field10.contents) , analysis_proposal.'field10.contents' , analysis_proposal)
| eval analysis_proposal=if( isnotnull(field20.contents) , analysis_proposal.'field20.contents', analysis_proposal)
The case command would only execute expression where the condition is matched. If you want to process all three conditions, try this:
...| eval analysis_proposal=if( isnotnull(field1) and field1=="my field 1 test.", analysis_proposal."legacy", analysis_proposal)
| eval analysis_proposal=if( isnotnull(field10.contents) , analysis_proposal.'field10.contents' , analysis_proposal)
| eval analysis_proposal=if( isnotnull(field20.contents) , analysis_proposal.'field20.contents', analysis_proposal)