Answer by warren for Can dictionary/json like objects be created using eval in splunk?

You can use sequential eval statements to make/overwrite fields in Splunk like this:

| eval publishedToIntegrator=if(len(raw)>0,"True","False")
| eval time=if(len(publishedToIntegrator)<5,_time,NULL)

However, knowing what you’re trying to accomplish will help us answer better.

from User warren – Stack Overflow https://stackoverflow.com/questions/75993438/can-dictionary-json-like-objects-be-created-using-eval-in-splunk/75995457#75995457
via IFTTT