topic Creating a Conditional Field using Field Extraction in Splunk Search

Creating a Conditional Field using Field Extraction

notimp47 — Wed, 30 Sep 2020 02:58:47 GMT

Hey everyone,

I am new to Splunk, and I need to create a new sourcetype along with field extractions. I am using regex expressions in props.conf and so far it is working well. But for the next field, the field name will depend on the value of two other fields that I have already successful extracted. Hence, my question is: is it possible to have a field that is only extracted depending on the values of other fields? And if these conditions aren't met then the field is not extracted at all?

For example, say we have two fields with these values in the logs.
If field_a = 1 AND field_b = a , then extract a field called c1 (which equals 1).
If field_a = 1 AND field_b != b , then do not extract anything.
If field_a = 4 AND field_b = b , then extract a field called c2 (which equals 4).

I know that this is easy to do in the search app interface on the web using SPL. But I want to be able to create this in the props.conf and so the field would be readily available while searching. Also, if this is possible, it would be a cool trick to learn.

Thank you.

Re: Creating a Conditional Field using Field Extraction

wenthold — Wed, 13 Nov 2019 18:33:18 GMT

I just noticed you have different destination fields for different conditions. Updated to reflect that.

The best bet might be to use an EVAL- statement in props.conf, using the case command:

EVAL-c1 = CASE(field_a=="1" AND field_b=="a",field_a)
EVAL-c2 = CASE(field_a=="4" AND field_b=="b",field_a)

This assumes you're trying to set the value c1 to whatever the field_a value is in certain conditions.

Re: Creating a Conditional Field using Field Extraction

richgalloway — Wed, 13 Nov 2019 18:35:45 GMT

You probably want a Calculated field. See Settings->Fields->Calculated fields.

Re: Creating a Conditional Field using Field Extraction

notimp47 — Thu, 14 Nov 2019 09:57:13 GMT

Thanks, this worked really well.

Re: Creating a Conditional Field using Field Extraction

notimp47 — Thu, 14 Nov 2019 09:58:57 GMT

Yes, this is results the same as the answer by wenthold. For people that prefer to use the web interface, they can use this approach. Thanks for your answer.