How to change value of an attribute using condition before indexing?

[spisiakmi]

Hi, I want to index simple xml file.

<?xml version="1.0" encoding="utf-8"?>
<unitData xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xsi:noNamespaceSchemaLocation="unitData-1.0.xsd" unit="0000006000" equipment="W052A-22G0014" operator="admin" starttime="2022-11-22T06:10:53+01:00" endtime="2022-11-22T06:15:07+01:00" state="ok">
</unitData>

Before indexing I would like to create new additional attribute machine which should have value depended of these conditions:

case equipment="W052A-22G0014" machine =machine1

case equipment="W052A-22G0013" machine =machine2

Can anybody help, please?

[PickleRick]

There are ways to define additional indexed fields but they should be used as rarely as possible. Your case seems as @gcusello pointed out more like an issue that can be solved with search-time lookup.

[gcusello]

Hi @spisiakmi,

why create this field before indexing?

You can create a calculated field at Search Time so you haven't to modify logs and it's easier.

Ciao.

Giuseppe

[spisiakmi]

Hi @gcusello

I try calculated field definitely. If you have a time to help me with it, it would be perfect. In this exact example.

m

[gcusello · Accepted solution]

Hi @spisiakmi,

you have to test and find the eval field calculation and then save it as a calculated field.

in your case you should try something like this:

<your_search>
| eval machine=case(equipment="W052A-22G0014","machine1", equipment="W052A-22G0013","machine2")

if the transformation correctly runs in the search, you can sate it in [Settings > Fields > Calculated Field > New Field] inserting the field name (machine) and the transformation.

Remember that you have to find a sourcetype to associate the transformation.

Ciao.

Giuseppe

[spisiakmi]

Hi @gcusello 

I wanna thank you very much. Your solution with calculated field was brilliant. Very simple and effective. Thank you.

[gcusello]

Hi @spisiakmi,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉