topic How do I convert values returned to another format? in Splunk Search

How do I convert values returned to another format?

djconroy — Tue, 06 May 2014 18:15:56 GMT

Is there a way when creating a table of syslog results that I can convert a value such as "17" to "udp" based on a set of predefined mappings, i.e. 1=icmp,6=tcp,17=udp,47=gre,50=esp?

Thanks!

Re: How do I convert values returned to another format?

mcmaster — Tue, 06 May 2014 18:31:00 GMT

You're probably looking for something like this:

http://docs.splunk.com/Documentation/Splunk/6.0.3/Knowledge/Addfieldsfromexternaldatasources

You'll want to define a CSV with the protocol number as one column, and the protocol name as the other. You can then use that in a lookup something like (not exact as you didn't provide details on your logs):

sourcetype=my-firewall | lookup protocols protocol_number OUTPUT protocol_name

You can see more on using the lookup command here:

http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/Lookup

Re: How do I convert values returned to another format?

somesoni2 — Tue, 06 May 2014 18:39:46 GMT

Lookups comes very handy for situations where additional static information to be added to result. Also, if the no of mapping is small and its to be used in only 1-2 places, you can use "eval-case" command to define those. [lookups are easily scalable though]