topic Re: Set a field to a value when it may or may not exist exist in Getting Data In

Set a field to a value when it may or may not exist exist

markwymer — Tue, 29 Sep 2020 07:21:41 GMT

Hi,
We have a specific logon event message that only has the word 'errorcode' if the logon fails - there is nothing to indicate a successful logon. A logon failure event looks something like |HDR+1|TIME+2015-09-22 22:14:57.646 GMT|DATA++LOGON:111.111.111.11:app name:deviceType-iPhone,deviceVersion-8.3,,,,connection-2,,membershipNumber-username@domain.com,,,,errorcode-MOB21038

A successful logon would be the same but without the last "error code" message.
If I was doing this in a shell script, I would do something like:-

if [ echo $event | grep -c "errorcode" -eq 1 ] ; then
Logon_Status="Failed"
else
Logon_Status="Successful"
fi

My question is, what would the FIELD EXTRACT look like in the props.con file to set Logon_Status to either "Successful" or "Failed"

(n.b. I can get the Logon_Status=Failed quite happily - it's just the other bit that has me stumped!)

Many thanks for any and all help,
Mark.

Re: Set a field to a value when it may or may not exist exist

richgalloway — Wed, 23 Sep 2015 04:23:35 GMT

Something like this should get you started.

<your event search> | eval Logon_Status=if(isnull(errorcode),"Successful","Failed") | ...

Re: Set a field to a value when it may or may not exist exist

markwymer — Tue, 29 Sep 2020 07:21:43 GMT

Hi Rich,
Thanks for the rapid response. In the short term I will use your solution but I was hoping that I could add it to my props.conf file e.g. "EXTRACT-Logon_Status = (some_convoluted_reg_expression).

Appreciate your help,
Mark.

Re: Set a field to a value when it may or may not exist exist

markwymer — Tue, 29 Sep 2020 07:21:46 GMT

Appreciate your help,
Mark.

Re: Set a field to a value when it may or may not exist exist

richgalloway — Wed, 23 Sep 2015 13:59:01 GMT

I'm not aware of any convoluted regexes that can find something that isn't there.

Re: Set a field to a value when it may or may not exist exist

somesoni2 — Wed, 23 Sep 2015 14:19:32 GMT

You should be able to add this eval statement in your props.conf as calculated fields, like this

EVAL-Logon_Status=if(isnull(errorcode),"Successful","Failed")

Re: Set a field to a value when it may or may not exist exist

richgalloway — Thu, 24 Sep 2015 15:08:35 GMT

I forgot about calculated fields. Good suggestion!

Re: Set a field to a value when it may or may not exist exist

richgalloway — Thu, 24 Sep 2015 15:09:43 GMT

I forgot about calculated fields. Good suggestion!