Splunk Search

Can I change the values of a specific column, given certain dates and certain values

HattrickNZ
Motivator

I havea a search that gives me the below:

    _time       A   B   C   D   
1   2016-01-01  1   3   5   7    
2   2016-01-02  1   3   5   7    
3   2016-01-03  1   3   5   7    
4   2016-01-04  1   3   5   7    
5   2016-01-05  1   3   5   7    
6   2016-01-06  1   3   5   7    
7   2016-01-07  1   3   5   7    
8   2016-01-08  1   3   5   7    

Can I change the values of a specific column, lets say column D, from the dates 2016-01-02 to 2016-01-07 to different numbers for each date, for simplicity
lets say 2,3,4,5,6,7?

This way I will get:

    _time       A   B   C   D   
1   2016-01-01  1   3   5   7    
2   2016-01-02  1   3   5   2    
3   2016-01-03  1   3   5   3    
4   2016-01-04  1   3   5   4    
5   2016-01-05  1   3   5   5    
6   2016-01-06  1   3   5   6    
7   2016-01-07  1   3   5   7    
8   2016-01-08  1   3   5   7

I have asked a similar question like this before here -
https://answers.splunk.com/answers/233206/how-to-control-values-of-a-field-relative-to-the-v.html

which involves eval tcheck=strptime("2015-04-29","%F") | eval test=if(_time<=tcheck,450,600) which I think I could use but it might become a bit verbose.
Can anyone advise if there is a better way?

Tags (4)
0 Karma
1 Solution

HattrickNZ
Motivator

the answer i ma looking for is, (one for each day, very verbose)

 eval tcheck=strptime("2016-01-02","%F") | eval D=if(_time==tcheck,2,D)

if there is spaces in your fields names:

 eval tcheck=strptime("2016-01-02","%F") | eval "A bcd"=if(_time==tcheck,2,'A bcd')

note, you will have to drop fields accordingly...

View solution in original post

0 Karma

HattrickNZ
Motivator

the answer i ma looking for is, (one for each day, very verbose)

 eval tcheck=strptime("2016-01-02","%F") | eval D=if(_time==tcheck,2,D)

if there is spaces in your fields names:

 eval tcheck=strptime("2016-01-02","%F") | eval "A bcd"=if(_time==tcheck,2,'A bcd')

note, you will have to drop fields accordingly...

0 Karma

somesoni2
Revered Legend

Do you have specific pattern of new values which will overwrite the column D for that date range? If there is a pattern, there could be a shortcut to do that but if those new values are hard-coded values with no patter, then a giant case statement is the only option.

0 Karma

HattrickNZ
Motivator

fraid not, don't think there is a pattern, if you have the time could you indulge me with an answer , one without a pattern and one with a pattern.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...