Splunk Enterprise

How to rename fields conditionally?

daniel_althoff8
Loves-to-Learn

Im trying to create multiple fields names from the same based on condition that other values are met. 

I need to do this multiple times in 1 search to create new field names

For example;

if event=av AND cmd=judgement then RENAME the field "result" to AV_Result
if event=spam AND cmd=judgement then RENAME the field "result" to Spam_Result
if action=quarantine AND mod=session AND cmd=kill then RENAME the field "Folder" to "Final_Folder_Result"

Id like to do all this in 1 search

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval AV_Result=if(event=="av" AND cmd=="judgement", result, null())
| eval Spam_Result=if(event=="spam" AND cmd=="judgement", result, null())
| eval Final_Folder_Result=if(action=="quarantine" AND mod=="session" AND cmd=="kill", Folder, null())
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can't do conditional rename, but you can do condition assignment, but here your origin and target fields are different along with the conditions, so what are you trying to achieve here?

You can do this for the first two

| eval {event}_Result=if(in(event, "av","spam") AND cmd="judgement", result, null())

which will create fields av_Result and spam_Result based on result, but it's not AV_Result or Spam_Result.

and this approach will not work for your Folder as everything is different, so what's the point?

An eval statement only has a single left hand side assignment and you are trying to assign 2 different fields to 3 different names...

 

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...