Knowledge Management

Help with trying to use two different calculated fields to populate the signature CIM field

johnward4
Communicator

I'm trying to use a calculated field eval statement like this below :

field : sonicwall_signature
case(like(message,"%Possible TCP Flood%"), "TCP Flood", like(category,"%Network_Scan_Activity%"), "Port Scanning")

Then I have another calculated field to combine an extracted field called threat and the above sonicwall_signature :

field : signature
coalesce(threat,sonicwall_signature)

This all works if I test both evals in a query but it doesn't seem to be working the way I intend it to using calculated fields to combine the threat and sonicwall_signature values. I'm not sure if this is because field extraction precedence but I would welcome a possible solution.

Thank you

0 Karma

DavidHourani
Super Champion

Hi @johnward4,

Instead of making these fields directly in the CIM and trying to chain them, go ahead and build the extractions on the original sourcetypes, this will give you a lot more flexibility and will allow you to have access to the field when running normal SPL searches without only having to use the DM for that.

You can also play around with the order in which Splunk handles field extraction and creation. You can see here the search time operation sequence:
https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/Searchtimeoperationssequence
It's very interesting what you can do with that as it will allow you to know the order in which things work and what can be chained to what. For example since field extraction comes second and eval comes fifth, you can use those two steps to build you search.

Let me know if you have more questions about how that order works, happy to help out.

Cheers,
David

0 Karma

skalliger
SplunkTrust
SplunkTrust

Hi,

sorry, but you can't chain calculated fields: https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/definecalcfields

Skalli

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...