topic [Help] Creating a new Field for matching Value in Splunk Search

[Help] Creating a new Field for matching Value

Zyon — Sun, 28 Jul 2013 14:14:54 GMT

Hi,

Currently, my Splunk search is:

sourcetype="Blacklist" OR sourcetype="log" | eval blacklisted=if(sourcetype=="Blacklist",_raw,null()) | fields - _raw | fields blacklisted,SRC

I am able to see two fields, blacklisted and SRC.

May i ask if it is possible to do the following:

Create a new field to store values that matches between the 2 fields.

Thanks a lot!

Re: [Help] Creating a new Field for matching Value

martin_mueller — Sun, 28 Jul 2013 18:38:19 GMT

If by "matches between the 2 fields" you mean if they equal each other, you can do this:

sourcetype="Blacklist" OR sourcetype="log" | eval blacklisted=if(sourcetype=="Blacklist",_raw,null()) | fields - _raw | fields blacklisted,SRC | eval matches = if(blacklisted==SRC, "match", "no match")

If you're thinking of something else then please elaborate.

Re: [Help] Creating a new Field for matching Value

gkanapathy — Sun, 28 Jul 2013 22:21:50 GMT

I think you should look at this:

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/CommonEvalFunctions

Re: [Help] Creating a new Field for matching Value

Zyon — Mon, 29 Jul 2013 00:44:45 GMT

Yes, this is what i'm thinking of. Thanks a lot!

Re: [Help] Creating a new Field for matching Value

Zyon — Mon, 29 Jul 2013 00:45:10 GMT

Thanks a lot!