topic Re: How do I create a new field? in Security

How do I create a new field?

or1515 — Thu, 09 Sep 2021 09:33:24 GMT

Hey splunkers,

How do I create a new field in splunk?

If I have a windows security log with "User" field and I want to call it and use it as "Account".

I tried we Eval but didn't succeed.

Thanks.

Re: How do I create a new field?

richgalloway — Thu, 09 Sep 2021 11:23:22 GMT

There are several ways to create a field, but eval perhaps is the most common. Please share your attempt so we can help determine what went wrong.

Re: How do I create a new field?

or1515 — Thu, 09 Sep 2021 11:35:34 GMT

This is the query:

index="net" sourcetype="Okta" eventType="user.account.privilege.grant"
In the log there is field called "Username".
I want to change it to "User".

You ask why?
I want to write a correlation rule from 2 different indexes and I want to use the same field for both.
Im waiting for an answer here: https://community.splunk.com/t5/Security/Correlation-rule/m-p/566419#M15581

Re: How do I create a new field?

isoutamo — Thu, 09 Sep 2021 11:39:25 GMT

Hi
try "rename Username as User"
r. Ismo