topic Re: How to have Field Values represent other field values? in Splunk Search

How to have Field Values represent other field values?

thomastaylor — Thu, 24 May 2018 21:01:15 GMT

Hello all!

I apologize for the oddly worded question. Currently, I have extracted fields from two separate log formats that provide different spellings of field values.

Examples:

Field Name: Status
Field Values: ERROR, INFO, CRITICAL, err, info

Since info and INFO are not the same string, this will provide two different metrics to work with. I would like to know if there is someway to merge the "info" into the "INFO" so that it's only seen as one metric. The same applies with err to ERROR as well. And, if there is no way to do this other than by a saved search, I can do that as well. Just let me know!

Thanks you so much for your time!

Re: How to have Field Values represent other field values?

somesoni2 — Thu, 24 May 2018 21:25:10 GMT

Do the distinct field Values are finite list? If yes, you can add a case statement in your search to normalize the values. e.g.

...| eval Status=case(match(Status,"^(?i)(ERR)"),"ERROR",match(Status,"^(?i)(INFO)"),"INFO",..other values )

Re: How to have Field Values represent other field values?

thomastaylor — Fri, 25 May 2018 13:18:21 GMT

Thank you for your answer!

We actually found a work-around solution where we tagged the statuses as "INFO" and "ERROR" for all the different log formats. We then did the search: index="main" | timechart count by tag::status and it achieved what we wanted.

Re: How to have Field Values represent other field values?

TISKAR — Fri, 25 May 2018 13:33:27 GMT

Hello,

You can use the tag or alias in Splunk, that acn help you to manage and organise your data

Regards

Re: How to have Field Values represent other field values?

somesoni2 — Fri, 25 May 2018 15:29:05 GMT

This is a great solution for problems like this. I've converted your comment as Answer so that you can accept this. Others with similar problem would then know that a working solution is available.