Splunk Search

Can I add constant field/value conditionally?

yk010123
Path Finder

I have the following query: 

 

 

 

 

"MyToken" status >= 400
| stats count by status,action

 

 

 

 

That produces a table like : 

status action count
404 action1 20
500 action2 30
400 action3 50

 

I would like to add a constant "description" depending on the status so that for example the output looks like : 

status action count description
404 action1 20 NOT FOUND
500 action2 30 INTERNAL ERROR
400 action3 50 INVALID Request

 

The description should map from the status

Labels (2)
0 Karma
1 Solution

seemanshu
Path Finder

Hi @yk010123 ,

You may use the following eval case to map the description with your status code,

| eval description=case(status=="404","NOT FOUND",status==500,"INTERNAL ERROR",status=="400","INVALID Request",1=1,"NULL")

Kindly support the answer if found helpful.

View solution in original post

seemanshu
Path Finder

Hi @yk010123 ,

You may use the following eval case to map the description with your status code,

| eval description=case(status=="404","NOT FOUND",status==500,"INTERNAL ERROR",status=="400","INVALID Request",1=1,"NULL")

Kindly support the answer if found helpful.

rut
Path Finder

Hi @yk010123, you can map a lookup file to the status codes using the following command:

 

| lookup http_status_codes_lookup.csv status OUTPUT description

 

This assumes you have a lookup file containing the fields status and description. If you don't yet have a lookup, you can add one through settings, lookups. You could start by getting a prefilled csv file at iana:

https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml

or

https://www.iana.org/assignments/http-status-codes/http-status-codes-1.csv

You can read more about adding lookups over here:

https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/Usefieldlookupstoaddinformationtoyourev...

Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...