Splunk Search

Enum for non numerical values

ndd
Engager

I have a non numerical field (text), and I want to create an enum field. 

Meaning that I will have a new field with numerical values that match the text values of the original field. 

Thanks 🙂

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval _raw="Id	Message	...
1	Success	...
2	Fail	...
3	Error	...
4	Success" | multikv forceheader=1
| table Id Message
| eventstats values(Message) as enum_key
| eval enum=mvfind(enum_key,Message)
| table Id Message enum

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval _raw="Id	Message	...
1	Success	...
2	Fail	...
3	Error	...
4	Success" | multikv forceheader=1
| table Id Message
| eventstats values(Message) as enum_key
| eval enum=mvfind(enum_key,Message)
| table Id Message enum
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ndd 

Can you please explain more with example like sample value of non numerical field and expected results from that field.

KV

0 Karma

ndd
Engager

Sure. 

Assume the following table

IdMessage...
1Success...
2Fail...
3Error...
4Success...

 

I want to get another field that will automatically assign a number to each message. (This number can be a random number or serial, what is important for me is that the numerical values from the new field correlate to the "message" field. 

IdMessage(New Field)...
1Success1...
2Fail2...
3Error3...
4Success1...
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ndd 

Can you please try this?

YOUR_SEARCH 
| eval anotherField=case(Message="Success",1,Message="Fail",2,Message="Error",3)

 

My Sample Search :

| makeresults | eval _raw="Id	Message	...
1	Success	...
2	Fail	...
3	Error	...
4	Success" | multikv forceheader=1
| table Id	Message | eval anotherField=case(Message="Success",1,Message="Fail",2,Message="Error",3)


 Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma

ndd
Engager

Hi KV, 

Actually I am looking to automatically assign the number. 

I have around 100 values of "message" therefore a "case when" type solution does not work here. 

The number that is assigned can be random, what is important is to be able to correlate between logs according to this new number field.

Is there a solution for this?

Thanks!

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...