Knowledge Management

How to use calculated fields created using Splunk Web in search?

indusbull
Explorer

Hi
I created a calculated field called "SUCCESS" using Splunk Web on sourcetype. The calculated field eval condition is like if(TYPE="S", "Success", null). Now I am trying to use this calculated field in my search like below -

index=customindex sourcetype=customsource | stats count(SUCCESS) as SuccessCount

But this returns no results and I know there are events in source that qualifies eval conditions. Not sure what I am doing wrong?

Before my search used to be like below for ref -

 index=customindex sourcetype=customsource | eval Success=if(TYPE=="S", "Success", null) | stats count(Success) as SuccessCount
0 Karma
1 Solution

niketn
Legend

@indusbull, since your second query is working, seems like issue is with how you have created Calculated field.

First thing you have to remember is that the field name that you use for Calculated Field will be case sensitive. So as per your second example the field name is actually Success and not SUCCESS.

Second, you can use case() instead of if() to set the Success field value to "SUCCESS", if TYPE="S" and do not set the value for any other type i.e. null. So the eval expression would be

|  eval Success=case(TYPE=="S","SUCCESS")

Following is how Calculated Field Configuration should look like. Please compare and validate (props.conf😞

[customsource]
EVAL-Success = case(TYPE=="S","SUCCESS")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@indusbull, since your second query is working, seems like issue is with how you have created Calculated field.

First thing you have to remember is that the field name that you use for Calculated Field will be case sensitive. So as per your second example the field name is actually Success and not SUCCESS.

Second, you can use case() instead of if() to set the Success field value to "SUCCESS", if TYPE="S" and do not set the value for any other type i.e. null. So the eval expression would be

|  eval Success=case(TYPE=="S","SUCCESS")

Following is how Calculated Field Configuration should look like. Please compare and validate (props.conf😞

[customsource]
EVAL-Success = case(TYPE=="S","SUCCESS")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

indusbull
Explorer

Thanks. The real issue was with if(). Using cas() solved it.

niketn
Legend

@indusbull, glad it worked. I am surprised though, as to how your second search worked with if()

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...