topic Re: Field name and value to another Field name with different value in Splunk Search

Field name and value to another Field name with different value

kyi — Fri, 12 May 2023 03:18:20 GMT

Hello All,

We have a extracted field (example field name "Field1) with multiple value such as YYN, YNN, NYN etc.

Based on the current field and field value, would like to have "NewFieldName" and match the result as below smaple.

Sample

Field1 NewFieldName

YYN "OK"

YNN "NOT OK"

NYN "NOT OK"

Thanks🙏

Re: Field name and value to another Field name with different value

yuanliu — Fri, 12 May 2023 05:03:03 GMT

You have not explained the logic to assign OK or not OK. You haven't even explained whether your real data is just three characters. If it is just that YYN has two "Y"s, this will do

| eval char = split(field1, "") | stats count by field1 char | where char == "Y" | eval NewFieldName = if(count == 2, "OK", "NOT OK")

Re: Field name and value to another Field name with different value

yeahnah — Fri, 12 May 2023 05:07:17 GMT

Hi @kyi

You sure can. Something like this run anywhere example

| makeresults | eval field1=split("YYN,YNN,NYN,YYY", ",") | mvexpand field1 ``` above creates dummy events and is not needed ``` ``` example below ``` | eval NewFieldName=case(field1="YYN", "OK", field1="YNN", "NOT OK", field1="NYN", "NOT OK", true(), "No match") | table field1 NewFieldName

Hope it helps

Re: Field name and value to another Field name with different value

kyi — Fri, 12 May 2023 05:30:04 GMT

Thanks for you information, will do more explanation next time.

Re: Field name and value to another Field name with different value

kyi — Fri, 12 May 2023 05:34:42 GMT

Thank You for your quick response and solution.

Apart from using Eval in the search, any other option we can use for matching?

For example: every time extracted field1 with value we can directly use NewFieldName and it matching value?