topic Re: Convert field extraction into summarized value in Splunk Search

Convert field extraction into summarized value

branfarm — Fri, 31 Aug 2012 18:47:22 GMT

Hi there,

I have a log that prefaces each message with either "Sending data on connection" or "Received data on connection". I have created an extraction to extract this value as "Direction", but I'd like to be able to show that result in a table as simply "Inbound" or "Outbound". Can anyone point me in the right direction for this?

Thanks in advance,

Brandon

Re: Convert field extraction into summarized value

Ayn — Fri, 31 Aug 2012 18:58:35 GMT

You could use eval. Let's say you extracted the values "Sending" and "Received", respectively:

... | eval dir_type=case(Direction,"Sending","Outbound","Received","Inbound")

Re: Convert field extraction into summarized value

branfarm — Fri, 31 Aug 2012 19:08:48 GMT

Thanks, Ayn. That worked, but seems very cumbersome in the search. Would a lookup table be able to accomplish this and keep the usability? For instance, enabling a user to use a search including direction=inbound ?

Re: Convert field extraction into summarized value

Ayn — Fri, 31 Aug 2012 19:51:40 GMT

Yes, you could use a lookup table for that. Also, in Splunk 5.0 that is due out...sometime in the future, you can setup eval statements in configuration files!