topic Re: Set field records & IF Statements in Splunk Search

Set field records & IF Statements

Kdeep — Mon, 28 Sep 2020 14:06:40 GMT

When I search my results I want it to update the field accordingly.

For example in my case when i search my Audit logs , The log contains the words "write control" and "Read control" within the text of the log but the field is set to Read Control instead of Write.

So if the log contains the word Write i want it to replace the field Accesses to Write instead of Read.

This is the search I am using

EventCode="5145" NOT Relative_Target_Name="Desktop.ini" NOT Share_Name="\*\IPC$" NOT Relative_Target_Name="\" | table Account_Name,Accesses, Share_Name,Relative_Target_Name,Da_te,Ti_me,AM_PM

Any help with this will be great...

Re: Set field records & IF Statements

kristian_kolb — Mon, 17 Jun 2013 08:30:53 GMT

It is not really clear what you want to achieve. Do you have problems with the field extraction?

Or do you want to rename the field, based on its value?

Please post a few sample events.

Re: Set field records & IF Statements

kristian_kolb — Mon, 17 Jun 2013 08:39:40 GMT

..or do you mean that you want to create a new field (within the search) based on some text in the event?

... | eval Accesses = if(match(_raw, "Write Control"), "Write", "Read")

The eval will create the field Accesses (or change it if it already exists). If the string "Write Control" exists within the event (_raw is the whole event), Accesses will be set to "Write", otherwise it will be set to "Read".

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/CommonEvalFunctions