topic Re: Populate predefined field for found strings in Splunk Search

Populate predefined field for found strings

subtrakt — Sat, 30 Mar 2013 14:13:14 GMT

Good Day,

I'm attempting to create a label for different search responses.

Example:
if search 'A' finds error "500", Field B. is populated with "test1"
if search 'A' finds error "400", Field B. is populated with "test2"

and soo on.

martin_mueller — Sat, 30 Mar 2013 19:34:20 GMT

You could do something like this:

... | eval B = case(search finds error "500", "test1", search finds error "400", "test2)

subtrakt — Sun, 31 Mar 2013 12:05:41 GMT

thanks. any idea how to tell it to only display if 400 are greater than 350 count?