Calculated field

[VijaySrrie]

Hi Team,

I need to create 3 calculated fields

| eval action=

case(error="invalid credentials", "failure", ((like('request.path',"auth/ldap/login/%") OR like('request.path',"auth/ldapco/login/%")) AND (valid="Success")) OR (like('request.path',"auth/token/lookup-self") AND ('auth.display_name'="root")) ,"success")

| eval app=

case(action="success" OR action="failure", "appname_Authentication")

| eval valid=

if(error="invalid credentials","Error","Success")

action field is dependant on valid
app field is dependant on action

I am unable to see app field in the splunk, may I know how to create it?

[gcusello]

Hi @VijaySrrie ,

they should work also using three different calculated fields, anyway, you could nest the conditions from the other calculated fields, even if the final caculated fied will be longer:

| eval action=
case(error="invalid credentials", "failure", ((like('request.path',"auth/ldap/login/%") OR like('request.path',"auth/ldapco/login/%")) AND (NOT error="invalid credentials")) OR (like('request.path',"auth/token/lookup-self") AND ('auth.display_name'="root")) ,"success")

| eval app=case(action="success" OR action="failure", "appname_Authentication")

| eval valid=if(error="invalid credentials","Error","Success")

Ciao.

Giuseppe