https://community.splunk.com/t5/Splunk-Search/How-to-fake-field-values/m-p/84678#M21588 <P>You can use a lookup. <CODE><A href="http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Addfieldsfromexternaldatasources" target="test_blank">http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Addfieldsfromexternaldatasources</A></CODE></P> <P>So the search would be something like: <CODE>foo_search| lookup ldapLookup err OUTPUT description | top description</CODE></P> Tue, 09 Oct 2012 15:53:46 GMT alacercogitatus 2012-10-09T15:53:46Z https://community.splunk.com/t5/Splunk-Search/How-to-fake-field-values/m-p/84677#M21587 <P>In our logs I will get field values like<BR /> err=0<BR /> err=1<BR /> .<BR /> .<BR /> .<BR /> err=49</P> <P>I am able to get the results when run search against "err" field. showing table as below<BR /> err count percent<BR /> 0 10 100.00%</P> <P>I want to show the results as <BR /> err count percent<BR /> Success 10 100.00%</P> <P>How can I rename the values in fields,is it possible if fields value is 0 then show it as "Success" </P> Tue, 09 Oct 2012 15:20:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fake-field-values/m-p/84677#M21587 splunkatl 2012-10-09T15:20:08Z https://community.splunk.com/t5/Splunk-Search/How-to-fake-field-values/m-p/84678#M21588 <P>You can use a lookup. <CODE><A href="http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Addfieldsfromexternaldatasources" target="test_blank">http://docs.splunk.com/Documentation/Splunk/5.0/Knowledge/Addfieldsfromexternaldatasources</A></CODE></P> <P>So the search would be something like: <CODE>foo_search| lookup ldapLookup err OUTPUT description | top description</CODE></P> Tue, 09 Oct 2012 15:53:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fake-field-values/m-p/84678#M21588 alacercogitatus 2012-10-09T15:53:46Z https://community.splunk.com/t5/Splunk-Search/How-to-fake-field-values/m-p/84679#M21589 <P>this works awesome. Thanks for prompt response<BR /> Here are the Steps I followed <BR /> 1)Created ldap_errcodes.csv as below <BR /> err,ldaperr_description<BR /> 1,Operations error<BR /> 2,Protocol error<BR /> 2)uploaded this file to Manger&gt;Lookups&gt;Look up table files<BR /> 3) gave the search<BR /> err| lookup ldap_errcodes.csv err OUTPUT ldaperr_description |top err,ldaperr_description</P> Mon, 28 Sep 2020 12:35:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fake-field-values/m-p/84679#M21589 splunkatl 2020-09-28T12:35:40Z