Creating a Conditional Field using Field Extraction

[notimp47]

Hey everyone,

I am new to Splunk, and I need to create a new sourcetype along with field extractions. I am using regex expressions in props.conf and so far it is working well. But for the next field, the field name will depend on the value of two other fields that I have already successful extracted. Hence, my question is: is it possible to have a field that is only extracted depending on the values of other fields? And if these conditions aren't met then the field is not extracted at all?

For example, say we have two fields with these values in the logs.
If fielda = 1 AND fieldb = a , then extract a field called c1 (which equals 1).
If fielda = 1 AND fieldb != b , then do not extract anything.
If fielda = 4 AND fieldb = b , then extract a field called c2 (which equals 4).

I know that this is easy to do in the search app interface on the web using SPL. But I want to be able to create this in the props.conf and so the field would be readily available while searching. Also, if this is possible, it would be a cool trick to learn.

Thank you.

[richgalloway]

You probably want a Calculated field. See Settings->Fields->Calculated fields.

[notimp47]

Yes, this is results the same as the answer by wenthold. For people that prefer to use the web interface, they can use this approach. Thanks for your answer.

[wenthold · Accepted solution]

I just noticed you have different destination fields for different conditions. Updated to reflect that.

The best bet might be to use an EVAL- statement in props.conf, using the case command:

EVAL-c1 = CASE(field_a=="1" AND field_b=="a",field_a)
EVAL-c2 = CASE(field_a=="4" AND field_b=="b",field_a)   

This assumes you're trying to set the value c1 to whatever the field_a value is in certain conditions.

[notimp47]

Thanks, this worked really well.