Set a field to a value when it may or may not exist exist

[markwymer]

Hi,
We have a specific logon event message that only has the word 'errorcode' if the logon fails - there is nothing to indicate a successful logon. A logon failure event looks something like |HDR+1|TIME+2015-09-22 22:14:57.646 GMT|DATA++LOGON:111.111.111.11:app name:deviceType-iPhone,deviceVersion-8.3,,,,connection-2,,membershipNumber-username@domain.com,,,,errorcode-MOB21038

A successful logon would be the same but without the last "error code" message.
If I was doing this in a shell script, I would do something like:-

if [ echo $event | grep -c "errorcode" -eq 1 ] ; then
Logon_Status="Failed"
else
Logon_Status="Successful"
fi

My question is, what would the FIELD EXTRACT look like in the props.con file to set Logon_Status to either "Successful" or "Failed"

(n.b. I can get the Logon_Status=Failed quite happily - it's just the other bit that has me stumped!)

Many thanks for any and all help,
Mark.

[markwymer]

Hi Rich,
Thanks for the rapid response. In the short term I will use your solution but I was hoping that I could add it to my props.conf file e.g. "EXTRACT-Logon_Status = (some_convoluted_reg_expression).

Appreciate your help,
Mark.

[richgalloway]

Something like this should get you started.

<your event search> | eval Logon_Status=if(isnull(errorcode),"Successful","Failed") | ...

[markwymer]

Hi Rich,
Thanks for the rapid response. In the short term I will use your solution but I was hoping that I could add it to my props.conf file e.g. "EXTRACT-Logon_Status = (some_convoluted_reg_expression).

Appreciate your help,
Mark.

[somesoni2]

You should be able to add this eval statement in your props.conf as calculated fields, like this

EVAL-Logon_Status=if(isnull(errorcode),"Successful","Failed") 

[richgalloway]

I forgot about calculated fields. Good suggestion!

[richgalloway]

I forgot about calculated fields. Good suggestion!

[richgalloway]

I'm not aware of any convoluted regexes that can find something that isn't there.