How can I eval a new field using only partial values from existing field?

SMWickman — Tue, 29 Sep 2020 18:07:46 GMT

Apologies if my question's title is non-descriptive. I am working through extracting an 'action' field from an existing values in the vendor_action field. Right now, there are multiple value results in the field 'vendor_action' and I'm looking to limit those results to only 2.

vendor_action field has values of "Radius Accounting, Passed_Authentications, Failed_Attempts, Administrative_and_Operational Audit.. etc.. etc..

I'm trying to just focus on "Passed_Authentications, and Failed_Attempts" and ultimately eval 'success' and 'failure' as the values of the action field. This is where I've gotten so far:

index=index sourcetype=sourcetype | eval action=if(vendor_action == "Passed_Authentications", "success", "failure") - this successfully extracts the action field and gives me 'success' where 'Passed_Authentications' is found but unfortunately defaults all other events to failure. I'm hoping to devise a way to ultimately create the action field and have it translate to success when vendor_action is equal to Passed_Authentications and failure when vendor_action is equal to Failed_Attemps and disregard all other vendor_action values.

Any help would be much appreciated!

Re: How can I eval a new field using only partial values from existing field?

richgalloway — Thu, 15 Feb 2018 17:32:15 GMT

Try case. This example sets action to "success" and "failure" as you want. Other values for vendor_action will assign NULL to action.

index=index sourcetype=sourcetype | eval action=case(vendor_action == "Passed_Authentications", "success", vendor_action=="Failed_Attempts", "failure")

Re: How can I eval a new field using only partial values from existing field?

SMWickman — Thu, 15 Feb 2018 17:36:24 GMT

Thank you very much!!!

topic Re: How can I eval a new field using only partial values from existing field? in Splunk Search

How can I eval a new field using only partial values from existing field?

Re: How can I eval a new field using only partial values from existing field?

Re: How can I eval a new field using only partial values from existing field?