- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![Mayanakhan Mayanakhan](https://community.splunk.com/legacyfs/online/avatars/512855.jpg)
Mayanakhan
Explorer
01-31-2018
07:48 AM
Hi
I want to add a priority as P3 for the below output.
Query
index=nonprod sourcetype=port_availability | dedup HostName |search Status!="Connection successful"| table _time HostName port Status priority|
Sample output
_time HostName port Status priority
1/31/2018 16:38 Hosthj 22 Connection failed
1/31/2018 16:38 Hostxyz 22 Connection timeout
1/31/2018 16:38 Hostghjyu 22 Connection failed
1/31/2018 16:38 Hostyuio 22 Connection failed
Expected output
_time HostName port Status priority
1/31/2018 16:38 Hosthj 22 Connection failed P3
1/31/2018 16:38 Hostxyz 22 Connection timeout P3
1/31/2018 16:38 Hostghjyu 22 Connection failed P3
1/31/2018 16:38 Hostyuio 22 Connection failed P3
Regards,
Mayana Khan
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![somesoni2 somesoni2](https://community.splunk.com/legacyfs/online/avatars/100305.jpg)
somesoni2
Revered Legend
01-31-2018
08:08 AM
Try like this (if the priority column has a value use that OR default it to P3)
index=nonprod sourcetype=port_availability | dedup HostName |search Status!="Connection successful"| table _time HostName port Status priority | eval priority=coalesce(priority,"P3")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![niketn niketn](https://community.splunk.com/legacyfs/online/avatars/299862.jpg)
niketn
Legend
01-31-2018
08:11 AM
@Mayanakhan, if you have priority
field in your indexed data and the same should display the value as P3
, then make sure you are using the correct case for priority field name i.e. field name Priority
is not same as priority
.
If you need to add static value of priority
as P3
for all the rows returned you can add | eval priority="P3"
as your final pipe.
<YourCurrentSearch>
| eval Priority="P3"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![Mayanakhan Mayanakhan](https://community.splunk.com/legacyfs/online/avatars/512855.jpg)
Mayanakhan
Explorer
01-31-2018
11:02 PM
Thanks its working!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![somesoni2 somesoni2](https://community.splunk.com/legacyfs/online/avatars/100305.jpg)
somesoni2
Revered Legend
01-31-2018
08:08 AM
Try like this (if the priority column has a value use that OR default it to P3)
index=nonprod sourcetype=port_availability | dedup HostName |search Status!="Connection successful"| table _time HostName port Status priority | eval priority=coalesce(priority,"P3")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![493669 493669](https://community.splunk.com/legacyfs/online/avatars/456647.jpg)
493669
Super Champion
01-31-2018
08:08 AM
Try this:
index=nonprod sourcetype=port_availability | dedup HostName|eval priority = if(Status=="Connection failed" OR Status=="Connection timeout","P3","")| table _time HostName port Status priority
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![Mayanakhan Mayanakhan](https://community.splunk.com/legacyfs/online/avatars/512855.jpg)
Mayanakhan
Explorer
01-31-2018
11:01 PM
It works... Thanks
![](/skins/images/FE4825B2128CA5F641629E007E333890/responsive_peak/images/icon_anonymous_message.png)