topic Re: Calculated field in Splunk Search

Calculated field

VijaySrrie — Wed, 05 Jun 2024 09:55:51 GMT

Hi Team,

I need to create 3 calculated fields

| eval action= case(error="invalid credentials", "failure", ((like('request.path',"auth/ldap/login/%") OR like('request.path',"auth/ldapco/login/%")) AND (valid="Success")) OR (like('request.path',"auth/token/lookup-self") AND ('auth.display_name'="root")) ,"success") | eval app= case(action="success" OR action="failure", "appname_Authentication") | eval valid= if(error="invalid credentials","Error","Success")

action field is dependant on valid
app field is dependant on action

I am unable to see app field in the splunk, may I know how to create it?

Re: Calculated field

gcusello — Wed, 05 Jun 2024 06:11:50 GMT

Hi @VijaySrrie ,

they should work also using three different calculated fields, anyway, you could nest the conditions from the other calculated fields, even if the final caculated fied will be longer:

| eval action= case(error="invalid credentials", "failure", ((like('request.path',"auth/ldap/login/%") OR like('request.path',"auth/ldapco/login/%")) AND (NOT error="invalid credentials")) OR (like('request.path',"auth/token/lookup-self") AND ('auth.display_name'="root")) ,"success") | eval app=case(action="success" OR action="failure", "appname_Authentication") | eval valid=if(error="invalid credentials","Error","Success")

Ciao.

Giuseppe