Splunk Search

Help with EVAL statement

efelder0
Communicator

I am extracting a field called "Severity" out of an XML data feed. and the values that are returned are severity 1, severity 2, severity 3, severity 4. I would like to re-assign the values to now say Low (instead of severity 1), Medium (instead of severity 2), High (instead of severity 3), Critical (instead of severity 4).

I am certain than an EVAL statement would work here, but not sure what the syntax is.

Any suggestions?

Tags (1)
0 Karma
1 Solution

bojanz
Communicator

This will work:

<your search> | eval Severity_string = case(Severity == 1, "Low", Severity == 2, "Medium", Severity == 3, "High", Severity == 4, "Critical")

Then just use Severity_string in table or whatever you use to display the results.

View solution in original post

bojanz
Communicator

This will work:

<your search> | eval Severity_string = case(Severity == 1, "Low", Severity == 2, "Medium", Severity == 3, "High", Severity == 4, "Critical")

Then just use Severity_string in table or whatever you use to display the results.

Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...