topic How to rename fields conditionally? in Splunk Enterprise

How to rename fields conditionally?

daniel_althoff8 — Fri, 31 Mar 2023 16:23:21 GMT

Im trying to create multiple fields names from the same based on condition that other values are met.

I need to do this multiple times in 1 search to create new field names

For example;

if event=av AND cmd=judgement then RENAME the field "result" to AV_Result
if event=spam AND cmd=judgement then RENAME the field "result" to Spam_Result
if action=quarantine AND mod=session AND cmd=kill then RENAME the field "Folder" to "Final_Folder_Result"

Id like to do all this in 1 search

Re: Rename Fields Conditionally

bowesmana — Fri, 31 Mar 2023 02:13:54 GMT

You can't do conditional rename, but you can do condition assignment, but here your origin and target fields are different along with the conditions, so what are you trying to achieve here?

You can do this for the first two

| eval {event}_Result=if(in(event, "av","spam") AND cmd="judgement", result, null())

which will create fields av_Result and spam_Result based on result, but it's not AV_Result or Spam_Result.

and this approach will not work for your Folder as everything is different, so what's the point?

An eval statement only has a single left hand side assignment and you are trying to assign 2 different fields to 3 different names...

Re: Rename Fields Conditionally

ITWhisperer — Fri, 31 Mar 2023 05:35:26 GMT

| eval AV_Result=if(event=="av" AND cmd=="judgement", result, null()) | eval Spam_Result=if(event=="spam" AND cmd=="judgement", result, null()) | eval Final_Folder_Result=if(action=="quarantine" AND mod=="session" AND cmd=="kill", Folder, null())