Can I add a priority field value as P3 for all the output?

[Mayanakhan]

Hi

I want to add a priority as P3 for the below output.

Query
    index=nonprod sourcetype=port_availability  | dedup HostName |search Status!="Connection successful"| table _time HostName port Status priority|

Sample output

---

_time                 HostName  port    Status                         priority
1/31/2018 16:38 Hosthj        22    Connection failed   
1/31/2018 16:38 Hostxyz      22 Connection timeout  
1/31/2018 16:38 Hostghjyu      22   Connection failed   
1/31/2018 16:38 Hostyuio         22 Connection failed   

Expected output

---

_time                 HostName  port    Status                         priority
1/31/2018 16:38 Hosthj       22 Connection failed                    P3
1/31/2018 16:38 Hostxyz     22  Connection timeout                 P3
1/31/2018 16:38 Hostghjyu     22    Connection failed                    P3
1/31/2018 16:38 Hostyuio       22   Connection failed                    P3

Regards,
Mayana Khan

[niketn]

@Mayanakhan, if you have priority field in your indexed data and the same should display the value as P3, then make sure you are using the correct case for priority field name i.e. field name Priority is not same as priority .

If you need to add static value of priority as P3 for all the rows returned you can add | eval priority="P3" as your final pipe.

<YourCurrentSearch>
| eval Priority="P3"

[Mayanakhan]

Thanks its working!!

[somesoni2 · Accepted solution]

Try like this (if the priority column has a value use that OR default it to P3)

 index=nonprod sourcetype=port_availability  | dedup HostName |search Status!="Connection successful"| table _time HostName port Status priority | eval priority=coalesce(priority,"P3")

[493669]

Try this:

 index=nonprod sourcetype=port_availability  | dedup HostName|eval priority = if(Status=="Connection failed" OR Status=="Connection timeout","P3","")| table _time HostName port Status priority

[Mayanakhan]

It works... Thanks