conditional switch in splunk

a_dev — Mon, 28 Sep 2020 09:38:12 GMT

Hi,

I have a splunk query which reads a log file and returns a list of values to a chart. However I need to values to be more "readable".
e.g. output:
$#@VALUE_1 ===> ONE

$#@VALUE_2 ===> TWO

$#@VALUE_3 ===> THREE

is there a way to say "if the value is $_VALUE_1, then output "ONE", else if the value is $_VALUE_2 then output "TWO"?

I am not able to modify what is written to the actual log

Re: conditional switch in splunk

mw — Wed, 01 Jun 2011 13:11:43 GMT

You can use "eval"/"case" to create a new field with the desired value. This assumes those values are in the same existing field

... | eval new_field=case(old_field == "$_VALUE_1", "ONE", old_field == "$_VALUE_2", "TWO")

topic conditional switch in splunk in Splunk Search

conditional switch in splunk

Re: conditional switch in splunk