Splunk Search

Can I add a priority field value as P3 for all the output?

Mayanakhan
Explorer

Hi

I want to add a priority as P3 for the below output.

Query
    index=nonprod sourcetype=port_availability  | dedup HostName |search Status!="Connection successful"| table _time HostName port Status priority|

Sample output


_time                 HostName  port    Status                         priority
1/31/2018 16:38 Hosthj        22    Connection failed   
1/31/2018 16:38 Hostxyz      22 Connection timeout  
1/31/2018 16:38 Hostghjyu      22   Connection failed   
1/31/2018 16:38 Hostyuio         22 Connection failed   

Expected output


_time                 HostName  port    Status                         priority
1/31/2018 16:38 Hosthj       22 Connection failed                    P3
1/31/2018 16:38 Hostxyz     22  Connection timeout                 P3
1/31/2018 16:38 Hostghjyu     22    Connection failed                    P3
1/31/2018 16:38 Hostyuio       22   Connection failed                    P3

Regards,
Mayana Khan

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try like this (if the priority column has a value use that OR default it to P3)

 index=nonprod sourcetype=port_availability  | dedup HostName |search Status!="Connection successful"| table _time HostName port Status priority | eval priority=coalesce(priority,"P3")

View solution in original post

niketn
Legend

@Mayanakhan, if you have priority field in your indexed data and the same should display the value as P3, then make sure you are using the correct case for priority field name i.e. field name Priority is not same as priority .

If you need to add static value of priority as P3 for all the rows returned you can add | eval priority="P3" as your final pipe.

<YourCurrentSearch>
| eval Priority="P3"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Mayanakhan
Explorer

Thanks its working!!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this (if the priority column has a value use that OR default it to P3)

 index=nonprod sourcetype=port_availability  | dedup HostName |search Status!="Connection successful"| table _time HostName port Status priority | eval priority=coalesce(priority,"P3")

493669
Super Champion

Try this:

 index=nonprod sourcetype=port_availability  | dedup HostName|eval priority = if(Status=="Connection failed" OR Status=="Connection timeout","P3","")| table _time HostName port Status priority

Mayanakhan
Explorer

It works... Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...