topic Re: Create a new field based on existing filelds in Splunk Search

Create a new field based on existing filelds

sidtalup27 — Tue, 08 Nov 2022 13:46:45 GMT

Hello,

My requirement is if the field "fields.summary" contains events that contain ".DT", then I want to create a new field "Summary", and set the value of the new field as Security Incident. I have created the below query, but its not working as expected.

index="main" AND source=jira | spath
| eval summary=if(match (fields.summary,".DT-"),"Security Incident","no")

Please advise.

--
Thanks,
Siddarth

Re: Create a new field based on existing filelds

ITWhisperer — Tue, 08 Nov 2022 14:00:08 GMT

The match function uses a regular expression syntax to match the value in the field - "." is a wildcard character in regular expressions so these (along with other special characters) need to be escaped. Field names with special characters should also be quoted with single quotes. Try this

index="main" AND source=jira | spath | eval summary=if(match ('fields.summary',"\.DT\-"),"Security Incident","no")