topic Re: custom text to the results in Splunk Enterprise

custom text to the results

selvam_sekar — Fri, 08 Dec 2023 15:04:05 GMT

Hi,

from the logs, i have extracted the below data(table1). I would like to add another column as in Table2 with custom keyword if filename begins xyz then "Core".

Please could you suggest what splunk query or logic we could apply?

Splunk Query:

base search | rex field User | rex field Folder | rex filed File | table User Folder File

Table1:

User	Folder	File
ABC	first	xyz07122023

Table 2: Required Output

User	Folder	File	Consumer
ABC	first	xyz07122023	Core

Re: custom text to the results

richgalloway — Fri, 08 Dec 2023 15:10:33 GMT

Use the eval command to add a field ("column"). The match function will compare a field to a string/regular expression.

Re: custom text to the results

selvam_sekar — Mon, 11 Dec 2023 10:00:03 GMT

Thanks, it worked as expected.

If we have 3 or multiple matches, do we required to write individual eval as mentioned below?

for example,

File	Consumer
XYZ_*	Core
ABC_*	Core
MNP_*	Non-Core
RST	Non-Core

SPL:

Re: custom text to the results

richgalloway — Mon, 11 Dec 2023 14:53:33 GMT

That won't work as expected. If File is "XYZ_*" then Consumer will be set to "" because of the last eval statement. For instances like this, use the case function.

Re: custom text to the results

selvam_sekar — Mon, 11 Dec 2023 14:25:04 GMT

Excellent! Many thanks.

is it possible if we make the non-matching of the below files to map "Others".

for example,

other than file name starts with xyz, ABC, MNP as Others.

Re: custom text to the results

richgalloway — Mon, 11 Dec 2023 14:54:32 GMT

See my updated reply. The last clause of this case function handles non-matches.

Re: custom text to the results

selvam_sekar — Mon, 11 Dec 2023 15:15:51 GMT

Thanks a lot