I have a value in my events called type, which is a single digit integer (1, 2, 3, etc.)
I would like to create a new string field in my search based on that value.
So, something like this pseudocode...
if type = 1 then desc = "pre"
if type = 2 then desc = "current"
if type = 3 then desc = "post"
I realize the splunk doesn't do if/then statements but I thought that was the easiest way to explain.
Thanks
Hi @tsheets13,
you have to use eval command with case option:
| eval desc=case(type="1","pre",type="2","current",type="3","post")
for more infos see at https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/ConditionalFunctions
Ciao.
Giuseppe
Hi @tsheets13,
you have to use eval command with case option:
| eval desc=case(type="1","pre",type="2","current",type="3","post")
for more infos see at https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/ConditionalFunctions
Ciao.
Giuseppe
Perfect! Thank you