Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How can I create a "null" or "blank" response in a field while converting strings into a new string value?

$
0
0
I am not sure how to approach what I am attempting to do. In short, I have a field that contains some specific strings that I intend to convert into a new string value inside a new field. For all the other strings in the first field that **do not match**, I want to provide a null or "blank" response in the new field. For example: original field values // New field value planetrainsautomobiles // modes of transportation applesPeachesblueberries // types of fruit random garbage I don't want // [blank] I know if I use the eval command in conjunction with replace I can change any string of text to what I want. What I can't figure out is how to "null" all the garbage I don't want to show in the new field when I display it in the table. Any help would be greatly appreciated.

Viewing all articles
Browse latest Browse all 47296

Trending Articles