Splunk Search

Enum for non numerical values

ndd
Engager

I have a non numerical field (text), and I want to create an enum field. 

Meaning that I will have a new field with numerical values that match the text values of the original field. 

Thanks 🙂

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval _raw="Id	Message	...
1	Success	...
2	Fail	...
3	Error	...
4	Success" | multikv forceheader=1
| table Id Message
| eventstats values(Message) as enum_key
| eval enum=mvfind(enum_key,Message)
| table Id Message enum

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval _raw="Id	Message	...
1	Success	...
2	Fail	...
3	Error	...
4	Success" | multikv forceheader=1
| table Id Message
| eventstats values(Message) as enum_key
| eval enum=mvfind(enum_key,Message)
| table Id Message enum
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ndd 

Can you please explain more with example like sample value of non numerical field and expected results from that field.

KV

0 Karma

ndd
Engager

Sure. 

Assume the following table

IdMessage...
1Success...
2Fail...
3Error...
4Success...

 

I want to get another field that will automatically assign a number to each message. (This number can be a random number or serial, what is important for me is that the numerical values from the new field correlate to the "message" field. 

IdMessage(New Field)...
1Success1...
2Fail2...
3Error3...
4Success1...
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ndd 

Can you please try this?

YOUR_SEARCH 
| eval anotherField=case(Message="Success",1,Message="Fail",2,Message="Error",3)

 

My Sample Search :

| makeresults | eval _raw="Id	Message	...
1	Success	...
2	Fail	...
3	Error	...
4	Success" | multikv forceheader=1
| table Id	Message | eval anotherField=case(Message="Success",1,Message="Fail",2,Message="Error",3)


 Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma

ndd
Engager

Hi KV, 

Actually I am looking to automatically assign the number. 

I have around 100 values of "message" therefore a "case when" type solution does not work here. 

The number that is assigned can be random, what is important is to be able to correlate between logs according to this new number field.

Is there a solution for this?

Thanks!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...