How do I edit my real-time search to add a value to events that are missing a certain field?

splunker9999 — Mon, 29 Feb 2016 15:26:12 GMT

We have the search below which gives us the count of all our URLs in events in real-time, but we have a few events where URL is missing.

Now we need to assign a certain URL value to those events which do not have a URL, but subsearch is not working for this as it is a real-time search.

For ex: We have events where URL is missing, but have the value "EXPRESS". We need to filter those events by this value and assign them a separate URL value called "EXPRESS.com". Can someone please suggest how we can do this?

Below is our search we used:

index=datapower host="10.71.8.170"  NOT URL=https://raly.com tag=prod  
|eval URL=case(URL="https://gita.com","ATON",URL="https://services.com",
"SERVICES",URL="https://soap.com","RAN",URL="https://www.care.com",
"CARE",URL="https://post.com","Post",
URL="http://get.com","GET",URL="https://master.com","Master",1=1,"Others")
|stats count(datapower_response_time) as count by URL|

For the search above, we need to add events that contain "Express" to EXPRESS.COM (as we don't have URL for these events)

Thanks..

Re: How do I edit my real-time search to add a value to events that are missing a certain field?

woodcock — Mon, 29 Feb 2016 18:00:18 GMT

If I am understanding you correctly (highly questionable), you can use this to add .com if it does not already exist.

... | eval URL=if((matc(URL, "\.com$")), URL, URL + ".com") ...

topic How do I edit my real-time search to add a value to events that are missing a certain field? in Splunk Search

How do I edit my real-time search to add a value to events that are missing a certain field?

Re: How do I edit my real-time search to add a value to events that are missing a certain field?