Knowledge Management

Help with trying to use two different calculated fields to populate the signature CIM field

johnward4
Communicator

I'm trying to use a calculated field eval statement like this below :

field : sonicwall_signature
case(like(message,"%Possible TCP Flood%"), "TCP Flood", like(category,"%Network_Scan_Activity%"), "Port Scanning")

Then I have another calculated field to combine an extracted field called threat and the above sonicwall_signature :

field : signature
coalesce(threat,sonicwall_signature)

This all works if I test both evals in a query but it doesn't seem to be working the way I intend it to using calculated fields to combine the threat and sonicwall_signature values. I'm not sure if this is because field extraction precedence but I would welcome a possible solution.

Thank you

0 Karma

DavidHourani
Super Champion

Hi @johnward4,

Instead of making these fields directly in the CIM and trying to chain them, go ahead and build the extractions on the original sourcetypes, this will give you a lot more flexibility and will allow you to have access to the field when running normal SPL searches without only having to use the DM for that.

You can also play around with the order in which Splunk handles field extraction and creation. You can see here the search time operation sequence:
https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/Searchtimeoperationssequence
It's very interesting what you can do with that as it will allow you to know the order in which things work and what can be chained to what. For example since field extraction comes second and eval comes fifth, you can use those two steps to build you search.

Let me know if you have more questions about how that order works, happy to help out.

Cheers,
David

0 Karma

skalliger
Motivator

Hi,

sorry, but you can't chain calculated fields: https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/definecalcfields

Skalli

0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...