Splunk Search

Add description to field value



I have a system log which contains different DNS error messages (in the 'Message' field) and I am looking for an easy way to provide a short, meaningful description for those messages, either by adding a new field representing each unique DNS error message, or by adding text to the Message field.

Here's an example; one event contains the following : 
Message="DNS name resolution failure (sos.epdg.epc.mnc720.mcc302.pub.3gppnetwork.org)"

This error is related to WiFi calling, so I would like to associate a description, or tag to that specific message, e.g. "WiFi calling".


Labels (1)
0 Karma


Depending on how many cases you have, you can either do it inline, with

| eval description=case(match(Message, "regex_expression1"), "Description1",
                        match(Message, "regex_expression2"), "Description2",
                        match(Message, "regex_expression3"), "Description3")

or probably more practical is to make a lookup - probably a wildcard based lookup, which means creating a CSV with Message, Description fields and then a lookup DEFINITION that has the match type set to 


In that you could then put things like

"DNS name resolution failure*" as the Message column and then a suitable description.

Using a wildcard type means you don't have to write SPL to extract particular bits of the message to determine the lookup attribute.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...