Solved: Create a Field Static Value Based on Rule - Splunk Community

Splunk Search

Hi,

I have a field called "Applications". I want to populate this field from events based on a patterns.

date: xxxxxx

foobar

Based on the above example, I want to check for date:xxxxx followed by "foobar" and populate the field "Applications" with "MyApplcationName".

How can I go about doing this?

Thank you,

Chris

1 Solution

Solution

You could do this:

yoursearchhere
| eval Applications=if(match(_raw,"date:xxxxx.*foobar"),"MyApplcationName",Applications)

You could even create a calculated field if you want this to be done automatically for every search.

View solution in original post

Solution

You could do this:

yoursearchhere
| eval Applications=if(match(_raw,"date:xxxxx.*foobar"),"MyApplcationName",Applications)

You could even create a calculated field if you want this to be done automatically for every search.

Perfect. Calculated fields is where I needed to be pointed to. Got it working.

Thank you!

Chris

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next. Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas Do you ever feel ...