Name | sku | kit |
NAC-D-CDSK-DLS-05.90 | NAC-D | HJA-JEOE-DNDN-94.4.0 |
This my data, I want to replace with NAC-D to ANT-P for multiple values
this is my search query
| eval sku = if(name=="",substr(kit,0,5),substr(name,0,5))
| eval sku=case(sku =="NAC-D","ANT-P ",sku =="DHV-K","ABD-U",true(),sku)
thanks, I got expected output
Hi @ramkyreddy ,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉
Hi @ramkyreddy,
what exactly is your requirement?
<your_search>
| eval sku = if(name="",substr(kit,0,5),substr(name,0,5))
| eval sku=case(sku="NAC-D","ANT-P",sku="DHV-K","ABD-U",true(),sku)
the search should work.
Ciao.
giuseppe