Dashboards & Visualizations

Add string to specific value

marco_massari11
Communicator

Hi,

I have a query like this:

index=star eventtype=login-history action=success Username=**

| stats count by Username
| sort - count
| head 10

So in my result I have a list of username with the login count for each one. I know some users are bot, so I want to add a string before the username like BOT_Username, probably with if condition. For example, in my result I have:

Alice  10

Bob   8

Carol    7

David   4

Eddie  2

I know Alice and Bob are bot, so I need:

BOT_Alice  10

BOT_Bob   8

Carol    7

David   4

Eddie  2

Thanks in advance!

 

Labels (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Do something like this

index=star eventtype=login-history action=success Username=**
| stats count by Username
| sort 10 -count
| eval Username=if(Username="Alice" OR Username="Bob", "BOT_".Username,Username)

 Update the if condition per your need.

View solution in original post

somesoni2
Revered Legend

Do something like this

index=star eventtype=login-history action=success Username=**
| stats count by Username
| sort 10 -count
| eval Username=if(Username="Alice" OR Username="Bob", "BOT_".Username,Username)

 Update the if condition per your need.

Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...