Splunk Enterprise

How to rename fields conditionally?

daniel_althoff8
Loves-to-Learn

Im trying to create multiple fields names from the same based on condition that other values are met. 

I need to do this multiple times in 1 search to create new field names

For example;

if event=av AND cmd=judgement then RENAME the field "result" to AV_Result
if event=spam AND cmd=judgement then RENAME the field "result" to Spam_Result
if action=quarantine AND mod=session AND cmd=kill then RENAME the field "Folder" to "Final_Folder_Result"

Id like to do all this in 1 search

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval AV_Result=if(event=="av" AND cmd=="judgement", result, null())
| eval Spam_Result=if(event=="spam" AND cmd=="judgement", result, null())
| eval Final_Folder_Result=if(action=="quarantine" AND mod=="session" AND cmd=="kill", Folder, null())
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can't do conditional rename, but you can do condition assignment, but here your origin and target fields are different along with the conditions, so what are you trying to achieve here?

You can do this for the first two

| eval {event}_Result=if(in(event, "av","spam") AND cmd="judgement", result, null())

which will create fields av_Result and spam_Result based on result, but it's not AV_Result or Spam_Result.

and this approach will not work for your Folder as everything is different, so what's the point?

An eval statement only has a single left hand side assignment and you are trying to assign 2 different fields to 3 different names...

 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...