Archive

Can I add a priority field value as P3 for all the output?

Explorer

Hi

I want to add a priority as P3 for the below output.

Query
    index=nonprod sourcetype=port_availability  | dedup HostName |search Status!="Connection successful"| table _time HostName port Status priority|

Sample output


_time                 HostName  port    Status                         priority
1/31/2018 16:38 Hosthj        22    Connection failed   
1/31/2018 16:38 Hostxyz      22 Connection timeout  
1/31/2018 16:38 Hostghjyu      22   Connection failed   
1/31/2018 16:38 Hostyuio         22 Connection failed   

Expected output


_time                 HostName  port    Status                         priority
1/31/2018 16:38 Hosthj       22 Connection failed                    P3
1/31/2018 16:38 Hostxyz     22  Connection timeout                 P3
1/31/2018 16:38 Hostghjyu     22    Connection failed                    P3
1/31/2018 16:38 Hostyuio       22   Connection failed                    P3

Regards,
Mayana Khan

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try like this (if the priority column has a value use that OR default it to P3)

 index=nonprod sourcetype=port_availability  | dedup HostName |search Status!="Connection successful"| table _time HostName port Status priority | eval priority=coalesce(priority,"P3")

View solution in original post

SplunkTrust
SplunkTrust

@Mayanakhan, if you have priority field in your indexed data and the same should display the value as P3, then make sure you are using the correct case for priority field name i.e. field name Priority is not same as priority .

If you need to add static value of priority as P3 for all the rows returned you can add | eval priority="P3" as your final pipe.

<YourCurrentSearch>
| eval Priority="P3"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Explorer

Thanks its working!!

0 Karma

SplunkTrust
SplunkTrust

Try like this (if the priority column has a value use that OR default it to P3)

 index=nonprod sourcetype=port_availability  | dedup HostName |search Status!="Connection successful"| table _time HostName port Status priority | eval priority=coalesce(priority,"P3")

View solution in original post

Super Champion

Try this:

 index=nonprod sourcetype=port_availability  | dedup HostName|eval priority = if(Status=="Connection failed" OR Status=="Connection timeout","P3","")| table _time HostName port Status priority

Explorer

It works... Thanks

0 Karma