I am making a basic chart from windows event logs and the chart looks like this:
SourceName="Microsoft-Windows-IIS-IISReset" | chart count by host EventCode
I only get two event codes back and they are 3201 and 3202, basically telling me IIS either started or stopped. What would I put in the search to do something like:
| RENAME (EventCode=3201,"Start") RENAME (EventCode=3202,"Stop")
I know this is a simple one, but I can't seem to find an example that fits what I am looking for. It may be because I am new to Splunk and just too and to dumb to understand unless it is in baby talk LOL.
Here you go:
SourceName="Microsoft-Windows-IIS-IISReset" | chart count by host EventCode|replace 3201 with Start in EventCode|replace 3202 with Stop in EventCode
Thanks! that got me on the right track, it didn't work with the replaces after the chart but when I put them in front of the pipe chart it worked!
SourceName="Microsoft-Windows-IIS-IISReset" | replace 3201 with Start in EventCode| replace 3202 with Stop in EventCode | chart count by host EventCode
This search code can also work
SourceName="Microsoft-Windows-IIS-IISReset"|eval IIS=if(EventCode==3201 , "Start" , "Stop")|rename IIS as EventCode | chart count by host EventCode
This alternate option also worked! I just had to know how it worked and reverse engineer it and now I know more about how the eval/if command I kept seeing pop up in other posts. I like the simplicity of the replace command so I will stick with it in this basic search but the gears in my head are grinding on how I would use the eval/if combination in other situations.
Thank you so much for posing an alternate option that tough me a another Spluk trick!