Convert field extraction into summarized value

[branfarm]

Hi there,

I have a log that prefaces each message with either "Sending data on connection" or "Received data on connection". I have created an extraction to extract this value as "Direction", but I'd like to be able to show that result in a table as simply "Inbound" or "Outbound". Can anyone point me in the right direction for this?

Thanks in advance,

Brandon

[Ayn]

You could use eval. Let's say you extracted the values "Sending" and "Received", respectively:

... | eval dir_type=case(Direction,"Sending","Outbound","Received","Inbound")

[Ayn]

Yes, you could use a lookup table for that. Also, in Splunk 5.0 that is due out...sometime in the future, you can setup eval statements in configuration files!

[branfarm]

Thanks, Ayn. That worked, but seems very cumbersome in the search. Would a lookup table be able to accomplish this and keep the usability? For instance, enabling a user to use a search including direction=inbound ?