Getting Data In

How to change value of an attribute using condition before indexing?

spisiakmi
Communicator

Hi, I want to index simple xml file.

<?xml version="1.0" encoding="utf-8"?>
<unitData xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xsi:noNamespaceSchemaLocation="unitData-1.0.xsd" unit="0000006000" equipment="W052A-22G0014" operator="admin" starttime="2022-11-22T06:10:53+01:00" endtime="2022-11-22T06:15:07+01:00" state="ok">
</unitData>

Before indexing I would like to create new additional attribute machine which should have value depended of these conditions:

case equipment="W052A-22G0014" machine =machine1

case equipment="W052A-22G0013" machine =machine2

Can anybody help, please?

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @spisiakmi,

you have to test and find the eval field calculation and then save it as a calculated field.

in your case you should try something like this:

<your_search>
| eval machine=case(equipment="W052A-22G0014","machine1", equipment="W052A-22G0013","machine2")

if the transformation correctly runs in the search, you can sate it in [Settings > Fields > Calculated Field > New Field] inserting the field name (machine) and the transformation.

Remember that you have to find a sourcetype to associate the transformation.

Ciao.

Giuseppe

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

There are ways to define additional indexed fields but they should be used as rarely as possible. Your case seems as @gcusello pointed out more like an issue that can be solved with search-time lookup.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @spisiakmi,

why create this field before indexing?

You can create a calculated field at Search Time so you haven't to modify logs and it's easier.

Ciao.

Giuseppe

0 Karma

spisiakmi
Communicator

Hi @gcusello

I try calculated field definitely. If you have a time to help me with it, it would be perfect. In this exact example.

m

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @spisiakmi,

you have to test and find the eval field calculation and then save it as a calculated field.

in your case you should try something like this:

<your_search>
| eval machine=case(equipment="W052A-22G0014","machine1", equipment="W052A-22G0013","machine2")

if the transformation correctly runs in the search, you can sate it in [Settings > Fields > Calculated Field > New Field] inserting the field name (machine) and the transformation.

Remember that you have to find a sourcetype to associate the transformation.

Ciao.

Giuseppe

spisiakmi
Communicator

Hi @gcusello 

I wanna thank you very much. Your solution with calculated field was brilliant. Very simple and effective. Thank you.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @spisiakmi,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...