Splunk Search

Calculated field

VijaySrrie
Builder

Hi Team,

I need to create 3 calculated fields

| eval action=

case(error="invalid credentials", "failure", ((like('request.path',"auth/ldap/login/%") OR like('request.path',"auth/ldapco/login/%")) AND (valid="Success")) OR (like('request.path',"auth/token/lookup-self") AND ('auth.display_name'="root")) ,"success")

| eval app=

case(action="success" OR action="failure", "appname_Authentication")

| eval valid=

if(error="invalid credentials","Error","Success")



action field is dependant on valid
app field is dependant on action

I am unable to see app field in the splunk, may I know how to create it?

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @VijaySrrie ,

they should work also using three different calculated fields, anyway, you could nest the conditions from the other calculated fields, even if the final caculated fied will be longer:

| eval action=
case(error="invalid credentials", "failure", ((like('request.path',"auth/ldap/login/%") OR like('request.path',"auth/ldapco/login/%")) AND (NOT error="invalid credentials")) OR (like('request.path',"auth/token/lookup-self") AND ('auth.display_name'="root")) ,"success")

| eval app=case(action="success" OR action="failure", "appname_Authentication")

| eval valid=if(error="invalid credentials","Error","Success")

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...