Knowledge Management

Splunk Calculated fields

Path Finder


I may be looking in the wrong place, but I am not able to find out information on how to use a few calculated fields.

I have a requirement like this,

If host = "host 1 or host 2 or host 3 . . . . . host10" -> mark clusterName as ClusterA
If host = "host 11 or host 12 or host 13 . . . . . host20" -> mark clusterName as ClusterB

I have attached the screenshot of the page to create calculated fields.

alt text

Is the below info correct?
Destination app - My custom app
Apply to - Host
named ---- WHAT SHOULD I GIVE???
Eval expression - host 1 or host 2 or host 3 . . . . . host10

Kindly help me out.

0 Karma

Ultra Champion

The Apply to selection gives the context/scope of the new field.

Name can be ClusterName.

The Eval expression can be -


 host == "host1", "ClusterA", 
 host == "host2", "ClusterA",
 host == "host3", "ClusterA",

.... to add the rest 

 host == "host11", "ClusterB", 
 host == "host12", "ClusterB",
 host == "host13", "ClusterB",

.... to add the rest 

By doing that you end up with a new field called ClusterName which would have either ClusterA or ClusterB as its value.

0 Karma

Super Champion

Here is a corrected answer....
In this case where you want to evaluate all hosts, then named would be *
Apply to = Host
Named = *
Name = your name for the resultant group
Eval expression = the expression that isolates the group

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!