Can I rename a range in the results of a transaction request

[ssaenger]

HI All,

I am trying to get results from a transaction request from users coming into the out systems.
There are various authentication steps that take place and I would like to capture those steps. There are 5 steps in a successful transaction, however, sometimes users come into the system multiple times, due to some type of issue.

I have managed to rename each step, however, if the eventcount is greater than 5, I would like to rename it "Multiple entries" or something similar. However, I cannot work out how do it. Is this possible in Splunk? Otherwise, I end up with a table/graph with fields 6, 8,12 etc.

index=int_sgw sourcetype=int_sgw_log | transaction SUB_ID maxspan=3m  | chart count over host by eventcount | rename 1 AS "Radius ACCESS fail", 2 AS "Radius START fail", 3 AS "Login fail", 4 AS "Continue fail", 5 AS "Successful"

Thanks in advance.

[richgalloway · Accepted solution]

Integers cannot be renamed, but perhaps this method will do.

... | chart count over host by eventcount | eval result=case(1, "Radius ACCESS fail", 2, "Radius START fail", 3, "Login fail", 4, "Continue fail", 5, "Successful",1=1,"") | ...

[ssaenger]

Hi Rich,

Your answer put me on the right track. Below is how I got it to work.
Thanks for your prompt response 🙂

index=int_sgw sourcetype=int_sgw_log | transaction SUB_ID maxspan=3m  | eval eventcount=case(eventcount=="1","Radius ACCESS fail", eventcount=="2","Radius START fail", eventcount=="3","Login fail", eventcount=="4","Continue fail", eventcount=="5","Successful")| chart count over host by eventcount | rename NULL as Multiple_connections

[jkat54]

Try this:

 index=int_sgw sourcetype=int_sgw_log | transaction SUB_ID maxspan=3m  | chart count AS C over host by eventcount | eval C=if(match(C,"1"),"Radius ACCESS fail",if(match(C,"2"),"Radius START fail"),if(match(C,"3"),"Login fail",if(match(C,"4"),"Continue fail",if(match(C,"5"),"Successful","Multiple Entries")))))  

[ssaenger]

Thanks for your response jkat54