Getting Data In

I created a field that has 3 values. How can I change one of the values from WARNING to WARN using lookups?

krishnani
New Member

I created a field and it has 3 values. I just want change one of the values from WARNING to WARN using lookups(.CSV). I also want to know how to configure it in props.conf.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this as your props.conf entry for field extraction

[yoursourcetype]
EXTRACT-logvalue=^=(?<logLevel>(WARN|\w+))

Working example (run anywhere search) to validate regex

| gentimes start=-1 | eval temp="=WARNING =ERROR =INFO =FATAL =SOMETHINGELSE" | table temp | makemv temp | mvexpand temp | rename temp as _raw | rex "^=(?<logLevel>(WARN|\w+))"

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this as your props.conf entry for field extraction

[yoursourcetype]
EXTRACT-logvalue=^=(?<logLevel>(WARN|\w+))

Working example (run anywhere search) to validate regex

| gentimes start=-1 | eval temp="=WARNING =ERROR =INFO =FATAL =SOMETHINGELSE" | table temp | makemv temp | mvexpand temp | rename temp as _raw | rex "^=(?<logLevel>(WARN|\w+))"
0 Karma

krishnani
New Member

I updated the my extracted field and values in props.conf like this

- EXTRACT-logvalue=^=(?(INFO|ERROR|WARN))
- it's working fine now but in the above config I hardcoded my values but I want to hardcode only WARN as in future we're expecting more values will come under same sourcetype. if a new value come in to the same sourcetype I need to hard code every value in props.conf.

So I would like to update my regex will update only from "WARNING" to "WARN" and rest other values (INFO,ERROR etc) need to add automatically to "logvalue" field without hardcoding.

Any suggestions on regex?

0 Karma

krishnani
New Member

sorry there is typo in config. here is the correct one

EXTRACT-logvalue=^=(?logvalue(INFO|ERROR|WARN))

0 Karma

gcusello
SplunkTrust
SplunkTrust

You can also modify it in your searches at search_time:
| eval yourfield=if(yourfield="WARNING","WARN",yourfield)
in this way tou maintain logs as originals and show them as you want
Bye.
Giuseppe

0 Karma

sundareshr
Legend

If you want to make the change before indexing, you could try sed to replace text. Something like this in your props should work

SEDCMD-warn = s/(WARNING)/WARN/g

PS: This will only affect new data coming in.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You want to change the value of an extracted field? Why you want to use lookup if you know which value to be replaced with which? You can achieve that using a simple eval/replace command. Further, same can be saved in props.conf on SH to make it happen automatically for your data.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...