topic Re: Can I add a priority field value as P3 for all the output? in Splunk Search

Can I add a priority field value as P3 for all the output?

Mayanakhan — Wed, 31 Jan 2018 15:48:00 GMT

I want to add a priority as P3 for the below output.

Query
    index=nonprod sourcetype=port_availability  | dedup HostName |search Status!="Connection successful"| table _time HostName port Status priority|

Sample output

_time                 HostName  port    Status                         priority
1/31/2018 16:38 Hosthj        22    Connection failed   
1/31/2018 16:38 Hostxyz      22 Connection timeout  
1/31/2018 16:38 Hostghjyu      22   Connection failed   
1/31/2018 16:38 Hostyuio         22 Connection failed

Expected output

_time                 HostName  port    Status                         priority
1/31/2018 16:38 Hosthj       22 Connection failed                    P3
1/31/2018 16:38 Hostxyz     22  Connection timeout                 P3
1/31/2018 16:38 Hostghjyu     22    Connection failed                    P3
1/31/2018 16:38 Hostyuio       22   Connection failed                    P3

Regards,
Mayana Khan

Re: Can I add a priority field value as P3 for all the output?

493669 — Wed, 31 Jan 2018 16:08:35 GMT

Try this:

 index=nonprod sourcetype=port_availability  | dedup HostName|eval priority = if(Status=="Connection failed" OR Status=="Connection timeout","P3","")| table _time HostName port Status priority

Re: Can I add a priority field value as P3 for all the output?

somesoni2 — Wed, 31 Jan 2018 16:08:52 GMT

Try like this (if the priority column has a value use that OR default it to P3)

 index=nonprod sourcetype=port_availability  | dedup HostName |search Status!="Connection successful"| table _time HostName port Status priority | eval priority=coalesce(priority,"P3")

Re: Can I add a priority field value as P3 for all the output?

niketn — Wed, 31 Jan 2018 16:11:23 GMT

@Mayanakhan, if you have priority field in your indexed data and the same should display the value as P3, then make sure you are using the correct case for priority field name i.e. field name Priority is not same as priority .

If you need to add static value of priority as P3 for all the rows returned you can add | eval priority="P3" as your final pipe.

<YourCurrentSearch>
| eval Priority="P3"

Re: Can I add a priority field value as P3 for all the output?

Mayanakhan — Thu, 01 Feb 2018 07:01:57 GMT

It works... Thanks

Re: Can I add a priority field value as P3 for all the output?

Mayanakhan — Thu, 01 Feb 2018 07:02:52 GMT

Thanks its working!!