Group my accounts

[jamfal]

I'm new to Splunk and my problem is:
I have a field called Environment which is composed of 7 elements (Backup, Production Pre-Production, Recipe, Qualification, Development, Integration).

And I wanted to group my accounts into 2 groups Production (Production, Pre-Prod, Backup) and off Prod (Recipe, development, qualification, integration

Thanks

[dineshraj9]

Try updating the same field or creating a new field -

| eval Environment=case(Environment=="Backup", "Production", Environment=="Pre-Prod", "Production", Environment=="Production","Production",Environment=="Recipe", "Off Prod", Environment=="Development", "Off Prod", Environment=="Qualification","Off Prod", Environment=="Integration","Off Prod")

OR

| eval ENV=case(Environment=="Backup", "Production", Environment=="Pre-Prod", "Production", Environment=="Production","Production",Environment=="Recipe", "Off Prod", Environment=="Development", "Off Prod", Environment=="Qualification","Off Prod", Environment=="Integration","Off Prod")

Note: Field names are case sensitive.

[niketn · Accepted solution]

You can pipe the following eval:

<Your Base Search>
| eval EnvironmentGroups=case(Environment="Backup" OR Environment="Pre-Prod" OR Environment="Production","Production", true(), "off Prod")

PS: You can also create a Calculated Field for the above if it applies for All events and all searches that you run.