Splunk Calculated fields

[namritha]

Hi,

I may be looking in the wrong place, but I am not able to find out information on how to use a few calculated fields.

I have a requirement like this,

If host = "host 1 or host 2 or host 3 . . . . . host10" -> mark clusterName as ClusterA
If host = "host 11 or host 12 or host 13 . . . . . host20" -> mark clusterName as ClusterB

I have attached the screenshot of the page to create calculated fields.

Is the below info correct?
Destination app - My custom app
Apply to - Host
named ---- WHAT SHOULD I GIVE???
Name-clusterName
Eval expression - host 1 or host 2 or host 3 . . . . . host10

Kindly help me out.

[ddrillic]

The Apply to selection gives the context/scope of the new field.

Name can be ClusterName.

The Eval expression can be -

case(

 host == "host1", "ClusterA", 
 host == "host2", "ClusterA",
 host == "host3", "ClusterA",

.... to add the rest 

 host == "host11", "ClusterB", 
 host == "host12", "ClusterB",
 host == "host13", "ClusterB",

.... to add the rest 
)

By doing that you end up with a new field called ClusterName which would have either ClusterA or ClusterB as its value.

[lukejadamec]

Here is a corrected answer....
In this case where you want to evaluate all hosts, then named would be *
Apply to = Host
Named = *
Name = your name for the resultant group
Eval expression = the expression that isolates the group