Solved: Create a Field Static Value Based on Rule - Splunk Community

Splunk Search

Hi,

I have a field called "Applications". I want to populate this field from events based on a patterns.

date: xxxxxx

foobar

Based on the above example, I want to check for date:xxxxx followed by "foobar" and populate the field "Applications" with "MyApplcationName".

How can I go about doing this?

Thank you,

Chris

1 Solution

Solution

You could do this:

yoursearchhere
| eval Applications=if(match(_raw,"date:xxxxx.*foobar"),"MyApplcationName",Applications)

You could even create a calculated field if you want this to be done automatically for every search.

View solution in original post

Solution

You could do this:

yoursearchhere
| eval Applications=if(match(_raw,"date:xxxxx.*foobar"),"MyApplcationName",Applications)

You could even create a calculated field if you want this to be done automatically for every search.

Perfect. Calculated fields is where I needed to be pointed to. Got it working.

Thank you!

Chris

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them. As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...