Archive

Create a Field Static Value Based on Rule

Contributor

Hi,

I have a field called "Applications". I want to populate this field from events based on a patterns.


date: xxxxxx

foobar

Based on the above example, I want to check for date:xxxxx followed by "foobar" and populate the field "Applications" with "MyApplcationName".

How can I go about doing this?

Thank you,

Chris

0 Karma
1 Solution

Legend

You could do this:

yoursearchhere
| eval Applications=if(match(_raw,"date:xxxxx.*foobar"),"MyApplcationName",Applications)

You could even create a calculated field if you want this to be done automatically for every search.

View solution in original post

0 Karma

Legend

You could do this:

yoursearchhere
| eval Applications=if(match(_raw,"date:xxxxx.*foobar"),"MyApplcationName",Applications)

You could even create a calculated field if you want this to be done automatically for every search.

View solution in original post

0 Karma

Contributor

Perfect. Calculated fields is where I needed to be pointed to. Got it working.

Thank you!

Chris

0 Karma