topic Re: Help require to define calculate field in Knowledge Management

Help require to define calculate field

sumitkathpal — Sun, 05 May 2019 07:30:54 GMT

Hi All,

I need to calculate field base on the below scenario.

need to create a new field signature but when field securityService = Antimalware then new signature field equals to securityService "" malwareCategory and if securityService = Antispam then signature field equals to securityService "" verdict .

Thanks in advance

Re: Help require to define calculate field

Sukisen1981 — Sun, 05 May 2019 07:45:56 GMT

please go through the eval documentation here https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Eval and here
https://docs.splunk.com/Documentation/Splunk/7.2.6/Search/Usetheevalcommandandfunctions
eval can be used with if, case just like other programming languages
Your requirement is also not very clear, you say - when field securityService = Antimalware then new signature field equals to securityService and you give an example in bold
securityService = Antispam then signature field equals to securityService
So when securityService = both Antispam or Antimalware your signature field should eval out to securityService?
What is the difference when you are setting the securityService feild to the same value?

Re: Help require to define calculate field

woodcock — Sun, 05 May 2019 23:09:47 GMT

Create a Calculated Field called signature defined like this:

case(securityService == "Antimalware", securityService "_"  malwareCategory, securityService == "Antispam", securityService "_" verdict, true(), "BROKEN/FIXME")

Re: Help require to define calculate field

sumitkathpal — Wed, 08 May 2019 01:43:55 GMT

Thanks @woodcock but if we add three fields than it stops working

case(securityService == "Antimalware", securityService + "" + malwareCategory, securityService == "Antispam", securityService + "" + verdict, true(), "BROKEN/FIXME") (This on is working under calculated field)

case(securityService == "Antimalware", securityService + "" + malwareCategory +""+ category , securityService == "Antispam", securityService + "" + verdict + "" + category , true(), "BROKEN/FIXME") (This on is working when you use this under search using eval command but when you define it under calculated field it stops working)