Splunk Search

Creating a Conditional Field using Field Extraction

notimp47
New Member

Hey everyone,

I am new to Splunk, and I need to create a new sourcetype along with field extractions. I am using regex expressions in props.conf and so far it is working well. But for the next field, the field name will depend on the value of two other fields that I have already successful extracted. Hence, my question is: is it possible to have a field that is only extracted depending on the values of other fields? And if these conditions aren't met then the field is not extracted at all?

For example, say we have two fields with these values in the logs.
If field_a = 1 AND field_b = a , then extract a field called c1 (which equals 1).
If field_a = 1 AND field_b != b , then do not extract anything.
If field_a = 4 AND field_b = b , then extract a field called c2 (which equals 4).

I know that this is easy to do in the search app interface on the web using SPL. But I want to be able to create this in the props.conf and so the field would be readily available while searching. Also, if this is possible, it would be a cool trick to learn.

Thank you.

0 Karma
1 Solution

wenthold
Communicator

I just noticed you have different destination fields for different conditions. Updated to reflect that.

The best bet might be to use an EVAL- statement in props.conf, using the case command:

EVAL-c1 = CASE(field_a=="1" AND field_b=="a",field_a)
EVAL-c2 = CASE(field_a=="4" AND field_b=="b",field_a)   

This assumes you're trying to set the value c1 to whatever the field_a value is in certain conditions.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You probably want a Calculated field. See Settings->Fields->Calculated fields.

---
If this reply helps you, Karma would be appreciated.

notimp47
New Member

Yes, this is results the same as the answer by wenthold. For people that prefer to use the web interface, they can use this approach. Thanks for your answer.

0 Karma

wenthold
Communicator

I just noticed you have different destination fields for different conditions. Updated to reflect that.

The best bet might be to use an EVAL- statement in props.conf, using the case command:

EVAL-c1 = CASE(field_a=="1" AND field_b=="a",field_a)
EVAL-c2 = CASE(field_a=="4" AND field_b=="b",field_a)   

This assumes you're trying to set the value c1 to whatever the field_a value is in certain conditions.

0 Karma

notimp47
New Member

Thanks, this worked really well.

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...