* The eval command is a Splunk command that allows you to create or modify fields using expressions .
* The if function is an expression that evaluates a condition and returns a value based on whether the condition is true or false. The syntax of the if function is if(X,Y,Z), where X is the condition, Y is the value to return if X is true, and Z is the value to return if X is false.
* The isnotnull function is an expression that returns true if the argument is not null, and false otherwise.
The syntax of the isnotnull function is isnotnull(X), where X is the argument to check.
* Therefore, the expression if (isnotnull (src), src, host) returns the value of src if it is not null, and the value of host otherwise. This means that it will provide a new value for host from src if it exists, and keep the original value of host otherwise.