Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Eval commands
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does anyone know if you do a rex and create a new field could you use that field for the eval commands?
IE:
| rex field=_raw "ACTION:\s(?.*) RETURNCODE"
| eval desc = case (action = "100", "Successfully Deleted")
| table user host action desc
Anyone know??
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes we can... once you have extracted the field you can impose any function on top of that..
index=test_core source=abc ctx "1015" "SNB" "USA" | rex field=_raw "ctx+]=[(?P\d+)" | dedup ctxx
| eval desc = case (ctxx = "80000000", "Successfully Deleted")
| table sourcetype host ctxx desc
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes we can... once you have extracted the field you can impose any function on top of that..
index=test_core source=abc ctx "1015" "SNB" "USA" | rex field=_raw "ctx+]=[(?P\d+)" | dedup ctxx
| eval desc = case (ctxx = "80000000", "Successfully Deleted")
| table sourcetype host ctxx desc
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That works.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You definitely can. If the rex command is working correctly the field qould be created and be available to any subsequent command.
Community Content Calendar, November Edition
October Community Champions: A Shoutout to Our Contributors!
Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!
