Extract field as status from different text strings

[jlimlogic]

We are feeding SNMP trap data from a video transcoding device into Splunk.

When a video feed goes down, the following text shows up in the SNMP Trap data:

"Low bitrate in source 'abc'"

The above effectively means that the video stream has gone down and is therefore streaming at zero bitrate.

and when the video stream is restored, the following text is received via an SNMP trap:

"Cleared condition (Low bitrate in source 'abc'"

We'd like to extract a new field called low_bitrate and set the value of the field to true or false, depending on the text string received in the snmp trap as detailed above.

[sundareshr · Accepted solution]

You can use calculated field to create the new field. Try something like this (you will have to edit the regex to your specific data)

base search | eval low_bitrate=case(match(_raw, "\sLow bitrate"), "true", match(_raw, "Cleared condition \s\(Low bitrare"), "false", 1=1., null())

http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Configurecalculatedfieldswithprops.conf

[jlimlogic]

Calculated field worked great - thanks!