Splunk Search

Creating a Conditional Field using Field Extraction

notimp47
New Member

Hey everyone,

I am new to Splunk, and I need to create a new sourcetype along with field extractions. I am using regex expressions in props.conf and so far it is working well. But for the next field, the field name will depend on the value of two other fields that I have already successful extracted. Hence, my question is: is it possible to have a field that is only extracted depending on the values of other fields? And if these conditions aren't met then the field is not extracted at all?

For example, say we have two fields with these values in the logs.
If field_a = 1 AND field_b = a , then extract a field called c1 (which equals 1).
If field_a = 1 AND field_b != b , then do not extract anything.
If field_a = 4 AND field_b = b , then extract a field called c2 (which equals 4).

I know that this is easy to do in the search app interface on the web using SPL. But I want to be able to create this in the props.conf and so the field would be readily available while searching. Also, if this is possible, it would be a cool trick to learn.

Thank you.

0 Karma
1 Solution

wenthold
Communicator

I just noticed you have different destination fields for different conditions. Updated to reflect that.

The best bet might be to use an EVAL- statement in props.conf, using the case command:

EVAL-c1 = CASE(field_a=="1" AND field_b=="a",field_a)
EVAL-c2 = CASE(field_a=="4" AND field_b=="b",field_a)   

This assumes you're trying to set the value c1 to whatever the field_a value is in certain conditions.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You probably want a Calculated field. See Settings->Fields->Calculated fields.

---
If this reply helps you, Karma would be appreciated.

notimp47
New Member

Yes, this is results the same as the answer by wenthold. For people that prefer to use the web interface, they can use this approach. Thanks for your answer.

0 Karma

wenthold
Communicator

I just noticed you have different destination fields for different conditions. Updated to reflect that.

The best bet might be to use an EVAL- statement in props.conf, using the case command:

EVAL-c1 = CASE(field_a=="1" AND field_b=="a",field_a)
EVAL-c2 = CASE(field_a=="4" AND field_b=="b",field_a)   

This assumes you're trying to set the value c1 to whatever the field_a value is in certain conditions.

0 Karma

notimp47
New Member

Thanks, this worked really well.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...