topic Re: Create a Field Static Value Based on Rule in Splunk Search

Create a Field Static Value Based on Rule

chrisboy68 — Fri, 16 Jan 2015 20:55:19 GMT

Hi,

I have a field called "Applications". I want to populate this field from events based on a patterns.

date: xxxxxx

Based on the above example, I want to check for date:xxxxx followed by "foobar" and populate the field "Applications" with "MyApplcationName".

How can I go about doing this?

Thank you,

Chris

lguinn2 — Fri, 16 Jan 2015 22:46:14 GMT

You could do this:

yoursearchhere
| eval Applications=if(match(_raw,"date:xxxxx.*foobar"),"MyApplcationName",Applications)

You could even create a calculated field if you want this to be done automatically for every search.

chrisboy68 — Mon, 19 Jan 2015 17:56:25 GMT

Perfect. Calculated fields is where I needed to be pointed to. Got it working.

Thank you!

Chris