Splunk Search

Edit data In Splunk

jokovitch
Explorer

I have a data in Splunk like

index="main"

FnameCountry
fname1USA
fname1USA
fname3USA

 

I want to add and change some data

where Fname="fname1"  I want to edit that Country = UK and add field of Phone =123

 

The final data will be

 

FnamePhone Country
fname1123UK
fname1123UK
fname3 USA

How can I do that?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jokovitch,

as @anilchaithu hinted, the correct search should be:

index=main
| eval Country=if(Fname="fname1","UK",Country), Phone=if(Fname="fname1","123","")
| table Fname Phone Country

if it doesn't run, check the fieldname (fields are case sensitive).

If doesn't run, please describe results and what's error.

Ciao.

Giuseppe

0 Karma

anilchaithu
Builder

@jokovitch 

you can use the below eval command for this task

eval Country = if(Fname="fname1", "UK", Fname), Phone= case(Fname="fname1", "123")

 

-- Hope this helps

0 Karma

jokovitch
Explorer
index="main" |eval Phone= case(Fname="fname1", "123")

I have tried this command , but nothing changed

0 Karma

anilchaithu
Builder

@jokovitch 

 

strange, try this. 

index="main" | eval Phone= case(like(Fname, "%fname1%", "123")

 

-- Hope this helps

0 Karma

jokovitch
Explorer

You need to change

 

index="main" | eval Phone= case(like(Fname, "%fname1%", "123")

 

to

 

index="main" | eval Phone= case(like(Fname, "%fname1%"), "123")

 

 

That still not change the data

 

Do I need to put this query in another place then New Search screen ? Or maybe is there place that I need to mark to commit this data?

 

 

0 Karma

jokovitch
Explorer

Do you have any idea how to fix that ?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...