topic Re: how to add a value to a fieldvalue if a certain field exists? in Splunk Search

how to add a value to a fieldvalue if a certain field exists?

avoelk — Tue, 07 Sep 2021 09:08:48 GMT

Hello everyone!

I struggle to find a way to add a value (for example 1) to a fieldvalue in case a certain field exists. Let's say this certain field is fieldx and it only exists and has a value, when you specifically block a port. After you've unblocked it, the field disappears.

what I'm currently looking at is a maxvalue of a field (for example the highest destination port number) so I go

index=firewall destport=*
|stats max(destport) as max_port

now I have my highest destination port. let's say it's 65000

what I'm now trying to accomplish is, that, if this port is currently blocked and the fieldx=blocked appears, I want to add a 1 to the max_port value -> 65001 and otherwise leave it be.

I've tried an eval if like that:

|eval maxport=if(isnotnull(fieldx),max_port+1,max_port)

but it doesn't work. do I have something wrong?

ps: in reality I don't know what the value of the fieldx is, so I can't just if(fieldx==blocked,...). but since the field only appears if there is a value in it to begin with, I would use that to my advantage.

also, is it possible to add the +1 only for a certain period of time ? for example add +1 to the value as long as it is in a two week frame ?

Re: how to add a value to a fieldvalue if a certain field exists?

PickleRick — Tue, 07 Sep 2021 08:08:41 GMT

Are you sure you're calling isnotnull on the right field? From what you describe you'd rather need

|eval maxport=if(isnotnull(fieldx),max_port+1,max_port)

And are you sure that you want a new column maxport or do you want to overwrite max_port?

Re: how to add a value to a fieldvalue if a certain field exists?

avoelk — Tue, 07 Sep 2021 08:26:52 GMT

True! tnx, I edited my question. I meant to put fieldx in it, not max_port.
actually I want to overwrite maxport, the new field was just to show whether my eval works or not (it doesn't).

Re: how to add a value to a fieldvalue if a certain field exists?

PickleRick — Tue, 07 Sep 2021 09:35:30 GMT

Well... should work

| makeresults | eval port=123 | eval port=if(isnotnull(fieldx),port+1,port)

Gives you port 123

| makeresults | eval port=123 | eval fieldx="whatever" | eval port=if(isnotnull(fieldx),port+1,port)

Gives 124.