Splunk Search

Enum for non numerical values

ndd
Engager

I have a non numerical field (text), and I want to create an enum field. 

Meaning that I will have a new field with numerical values that match the text values of the original field. 

Thanks 🙂

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval _raw="Id	Message	...
1	Success	...
2	Fail	...
3	Error	...
4	Success" | multikv forceheader=1
| table Id Message
| eventstats values(Message) as enum_key
| eval enum=mvfind(enum_key,Message)
| table Id Message enum

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval _raw="Id	Message	...
1	Success	...
2	Fail	...
3	Error	...
4	Success" | multikv forceheader=1
| table Id Message
| eventstats values(Message) as enum_key
| eval enum=mvfind(enum_key,Message)
| table Id Message enum
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ndd 

Can you please explain more with example like sample value of non numerical field and expected results from that field.

KV

0 Karma

ndd
Engager

Sure. 

Assume the following table

IdMessage...
1Success...
2Fail...
3Error...
4Success...

 

I want to get another field that will automatically assign a number to each message. (This number can be a random number or serial, what is important for me is that the numerical values from the new field correlate to the "message" field. 

IdMessage(New Field)...
1Success1...
2Fail2...
3Error3...
4Success1...
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ndd 

Can you please try this?

YOUR_SEARCH 
| eval anotherField=case(Message="Success",1,Message="Fail",2,Message="Error",3)

 

My Sample Search :

| makeresults | eval _raw="Id	Message	...
1	Success	...
2	Fail	...
3	Error	...
4	Success" | multikv forceheader=1
| table Id	Message | eval anotherField=case(Message="Success",1,Message="Fail",2,Message="Error",3)


 Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma

ndd
Engager

Hi KV, 

Actually I am looking to automatically assign the number. 

I have around 100 values of "message" therefore a "case when" type solution does not work here. 

The number that is assigned can be random, what is important is to be able to correlate between logs according to this new number field.

Is there a solution for this?

Thanks!

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...