Splunk Enterprise

How do I make a string into a field / variable?

hollybross1219
Path Finder

Hello, my raw logs look something like this: 

Example 1:

2021-02-03 23:59:07,216 LogLevel=INFO my_appid= intuit_tid=EFEtoPBI805aaa9f-9254-499b-ae80-    2c39ca7b33cd provider_tid=fe62e521-a9c6-4d3a-8c45-a25a10abd5ac     class=com.intuit.fds.provider.dao.impl.EinDAOImpl Get disabled ein by ein=821570477

Example 2:

2021-02-03 23:59:07,216 LogLevel=INFO my_appid= intuit_tid=EFEtoPBI805aaa9f-9254-499b-ae80-2c39ca7b33cd provider_tid=fe62e521-a9c6-4d3a-8c45-a25a10abd5ac class=com.intuit.fds.provider.service.impl.EinServiceImpl Create or update ein=821570477 einVO=EinVO [ein=821570477, active=false, einProviderRelationships=EinProviderRelationshipsVO [einProviderRelationship=[EinProviderRelationshipVO [id=null, active=null, providerId=5ece3c4d-6791-4bed-bbf5-fd9c0736c129, taxYear=2020, serviceName=W2, actualAvailabilityDate=2021-02-03T23:59:07.172-08:00, expectedAvailabilityDate=2021-02-03T23:59:07.172-08:00, preference=1, synced=false]]]]

My goal is to create a single field / variable (let's call it action_type) where the value of that field is determined by the presence of the string "Create or update" (action_type=add) or "Get disabled" (action_type=disable). 

My struggle is that these strings aren't associated with any fields, so I'm not sure how to have my eval include the LIKE function without defining a field. Please help!

My work:

[base query]

|eval action_type=CASE( LIKE(??, "Get disabled"), "disable", LIKE(??, "Create or update"), "add", 1==1, "null")

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @hollybross1219,

You can use _raw field with match;

| eval action_type=CASE( match(_raw, "Get disabled"), "disable", match(_raw, "Create or update"), "add", 1==1, "null")
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

hollybross1219
Path Finder

Thank you @scelikok !!

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @hollybross1219,

You can use _raw field with match;

| eval action_type=CASE( match(_raw, "Get disabled"), "disable", match(_raw, "Create or update"), "add", 1==1, "null")
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...