topic Re: Creating a new field from another field in Splunk Search

Creating a new field from another field

emcglade — Thu, 06 Jan 2022 10:56:48 GMT

Hi,

Wondering if anyone can help.

I am trying to create a new field called FS_Owner_Mail using |eval from both the mail and FS_Owner existing fields but not too sure how to work it into the below search.

index=varonis sourcetype=xxx:varonis:csv:reports
| eval User_Group=replace(replace('User_Group',"xxxxl\\\\","")," ","")
| join type=left User_Group
[ search index=ad source=xxx_adgroupmemberscan memberSamAccountName="*_xxx" earliest=-48h
| dedup groupSamAccountName, memberSamAccountName
| rename groupSamAccountName as User_Group, memberSamAccountName as Member
| join type=left Member
[ search index=ad source="xxx_aduserscan" samAccountName="*_xxx"
| dedup samAccountName
| rename samAccountName as Member
| table Member, displayName, mail]
| stats values(Member) as Member, values(displayName) as DisplayName, values(mail) as Mail by User_Group
| eval User_Group=replace(replace('User_Group',"_xxx","")," ","")]
| table Access_Path Current_Permissions, DisplayName, FS_Owner, Flags, Inherited_From_Folders, Mail, Member, User_Group

Re: Creating a new field from another field

ITWhisperer — Thu, 06 Jan 2022 11:45:44 GMT

| eval FS_Owner_Mail=FS_Owner."_".Mail

Re: Creating a new field from another field

emcglade — Thu, 06 Jan 2022 12:08:11 GMT

Thank you, looks great!

can you explain the logic and where it would best be in the search?

Re: Creating a new field from another field

ITWhisperer — Thu, 06 Jan 2022 12:35:00 GMT

At the end when you have values for FS_Owner and Mail?

Re: Creating a new field from another field

emcglade — Thu, 06 Jan 2022 13:01:08 GMT

Perfect looks really good!