topic Re: Transformation fields using Splunk UI in Splunk Search

Transformation fields using Splunk UI

veera9 — Sun, 24 Sep 2017 00:38:52 GMT

Team,
I need help in defining 3 new fields using Splunk User interface.

Decision=Agree , Field Name should be "Decision" and Matching values is "Agree".
Fieldname is "Time" , need this in the Timestamp format ( Dateand HH:MM:SS)
SourceIP

Any help is greatly appreciated.

Re: Transformation fields using Splunk UI

Sukisen1981 — Sun, 24 Sep 2017 11:44:14 GMT

1- Not clear, assuming you have a field, say X which has 'agree' and other values, if so try
eval Decision=Case(X="Agree","Decision")
2- eval Time=strftime(_time,"%d %H:%M:%S"). Are you missing year and/ or month components?
3- Witthout looking at your data its is hard to say but have you looked at this? ip extraction is very common question answered many times befre

https://answers.splunk.com/answers/49448/extract-ip-address-with-rex-or-trim.html
https://answers.splunk.com/answers/48882/need-to-extract-ip-address.html
https://answers.splunk.com/answers/438684/rex-ip-address-extraction.html

Re: Transformation fields using Splunk UI

cpetterborg — Sun, 24 Sep 2017 13:25:22 GMT

As @Sukisen1981 says, example data is needed. Without it, almost any answer will be a shot in the dark. You can obfuscate the data, but don't change the nature of it so that it is useful in helping you.

Re: Transformation fields using Splunk UI

veera9 — Sun, 24 Sep 2017 15:39:12 GMT

Is it OK to use "eval" in the Splunk field transformation UI?

Re: Transformation fields using Splunk UI

cpetterborg — Sun, 24 Sep 2017 19:47:07 GMT

As far as I know there is no way to do eval type expression in the Transformations. Not in the UI, or in the .conf files.

Re: Transformation fields using Splunk UI

veera9 — Sun, 24 Sep 2017 20:21:42 GMT

Thank you so much. Below are my requirements:

I want to define a field using the UI in Field Transformations in Field settings:

The field need to match a string value ex: "Agreed". I want the field name to be defined as "Decision".

When I search in the search box, I want the field "Decision" to appear in the list of fields.
Thank you for your time.
Raghu

Re: Transformation fields using Splunk UI

cpetterborg — Sun, 24 Sep 2017 21:30:29 GMT

You may want a transform. You may want a field extraction. They are similar. If the fields you want are related to a sourcetype, or to a source, then do a field extraction. If you want it to happen on any data, then do a transform.

But, I can't help you without an example data to look at. Just to look for a string and then make a field could be useful, and may not be. I assume from your description that you could have something other than Agreed as a value for Decision, otherwise you would never care about doing a field extraction. What you ask for without an example is equivalent to marking everything blue that you see as your favorite car.