Knowledge Management

Help with trying to use two different calculated fields to populate the signature CIM field

Communicator

I'm trying to use a calculated field eval statement like this below :

field : sonicwallsignature
case(like(message,"%Possible TCP Flood%"), "TCP Flood", like(category,"%Network
Scan_Activity%"), "Port Scanning")

Then I have another calculated field to combine an extracted field called threat and the above sonicwall_signature :

field : signature
coalesce(threat,sonicwall_signature)

This all works if I test both evals in a query but it doesn't seem to be working the way I intend it to using calculated fields to combine the threat and sonicwall_signature values. I'm not sure if this is because field extraction precedence but I would welcome a possible solution.

Thank you

0 Karma

SplunkTrust
SplunkTrust

Hi @johnward4,

Instead of making these fields directly in the CIM and trying to chain them, go ahead and build the extractions on the original sourcetypes, this will give you a lot more flexibility and will allow you to have access to the field when running normal SPL searches without only having to use the DM for that.

You can also play around with the order in which Splunk handles field extraction and creation. You can see here the search time operation sequence:
https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/Searchtimeoperationssequence
It's very interesting what you can do with that as it will allow you to know the order in which things work and what can be chained to what. For example since field extraction comes second and eval comes fifth, you can use those two steps to build you search.

Let me know if you have more questions about how that order works, happy to help out.

Cheers,
David

0 Karma

SplunkTrust
SplunkTrust

Hi,

sorry, but you can't chain calculated fields: https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/definecalcfields

Skalli

0 Karma