Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Knowledge Management
- :
- Workflow Action "case sensitivity" question
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have a workflow action that creates a link to an external site based on information in a particular field and eventtype.
The problem i have noticed is that in splunk the field i have chosen for this workflow action is displayed in logs like this: 6411-CP.
This field is inserted into a URL which users can access from a link in splunk. The problem now is the link they access doesn't like the CP being capital. The link returns no results with 6411-CP but does return results with 6411-cp.
Any ideas on how to get splunk to maybe change upper case to lower case for a workflow action using a link?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well I think you have a couple of ways you could go about this. If you are using the workflow action on a saved search, you could simply add an eval statement to change the field to lowercase in the results, so when the workflow action is triggered it will use the lowercase field:
your search terms | eval my_field=lower(my_field)
Alternatively, you could convert the data to lowercase at index time using SEDCMD to substitute characters.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If that answer solved your problem, can you please click the check mark next to the answer? It will mark this questions as answered and help keep the site clean.
Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well I think you have a couple of ways you could go about this. If you are using the workflow action on a saved search, you could simply add an eval statement to change the field to lowercase in the results, so when the workflow action is triggered it will use the lowercase field:
your search terms | eval my_field=lower(my_field)
Alternatively, you could convert the data to lowercase at index time using SEDCMD to substitute characters.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That worked...thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'll give that a shot.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
