Splunk Search

Can I add constant field/value conditionally?

yk010123
Path Finder

I have the following query: 

 

 

 

 

"MyToken" status >= 400
| stats count by status,action

 

 

 

 

That produces a table like : 

status action count
404 action1 20
500 action2 30
400 action3 50

 

I would like to add a constant "description" depending on the status so that for example the output looks like : 

status action count description
404 action1 20 NOT FOUND
500 action2 30 INTERNAL ERROR
400 action3 50 INVALID Request

 

The description should map from the status

Labels (2)
0 Karma
1 Solution

seemanshu
Path Finder

Hi @yk010123 ,

You may use the following eval case to map the description with your status code,

| eval description=case(status=="404","NOT FOUND",status==500,"INTERNAL ERROR",status=="400","INVALID Request",1=1,"NULL")

Kindly support the answer if found helpful.

View solution in original post

seemanshu
Path Finder

Hi @yk010123 ,

You may use the following eval case to map the description with your status code,

| eval description=case(status=="404","NOT FOUND",status==500,"INTERNAL ERROR",status=="400","INVALID Request",1=1,"NULL")

Kindly support the answer if found helpful.

rut
Path Finder

Hi @yk010123, you can map a lookup file to the status codes using the following command:

 

| lookup http_status_codes_lookup.csv status OUTPUT description

 

This assumes you have a lookup file containing the fields status and description. If you don't yet have a lookup, you can add one through settings, lookups. You could start by getting a prefilled csv file at iana:

https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml

or

https://www.iana.org/assignments/http-status-codes/http-status-codes-1.csv

You can read more about adding lookups over here:

https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/Usefieldlookupstoaddinformationtoyourev...

Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...