Splunk Search

Create static fields after matching the field value

RSS_STT
Explorer

I want to create one static field by looking status value = Issue

hostm_nnamestatus
AcpuOk
BdiskOk
CmemoryIssue
DnetwokOk
EstorageIssue

 

Issue found in status column few field heath created with Bad value.

Like below.

hostm_nnamestatusHealth
AcpuOkBad
BdiskOkBad
CmemoryIssueBad
DnetwokOkBad
EstorageIssueBad

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eventstats values(eval(if(status="Issue","Bad",null()))) as Health
| fillnull value="Ok" Health

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

It's not clear how the health field is calculated. One way is what @ITWhisperer showed but it won't match your mockup results - you have health=bad all acros the board.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are you saying that you want a health field that has "Bad" in for all the events if any of the events have status="Issue"?

0 Karma

RSS_STT
Explorer

Yes, Your understanding is correct.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eventstats values(eval(if(status="Issue","Bad",null()))) as Health
0 Karma

RSS_STT
Explorer

It's missing the fields value if all Ok. 

I need Health field to be populated with Ok if all status field have all Ok value.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eventstats values(eval(if(status="Issue","Bad",null()))) as Health
| fillnull value="Ok" Health

richgalloway
SplunkTrust
SplunkTrust

Use the eval command to create a field.

| eval Health = if(status="Issue", "Bad", "Ok")

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...