Splunk Search

How can I eval a new field using only partial values from existing field?

SMWickman
Explorer

Apologies if my question's title is non-descriptive. I am working through extracting an 'action' field from an existing values in the vendor_action field. Right now, there are multiple value results in the field 'vendor_action' and I'm looking to limit those results to only 2.

vendor_action field has values of "Radius Accounting, Passed_Authentications, Failed_Attempts, Administrative_and_Operational Audit.. etc.. etc..

I'm trying to just focus on "Passed_Authentications, and Failed_Attempts" and ultimately eval 'success' and 'failure' as the values of the action field. This is where I've gotten so far:

index=index sourcetype=sourcetype | eval action=if(vendor_action == "Passed_Authentications", "success", "failure") - this successfully extracts the action field and gives me 'success' where 'Passed_Authentications' is found but unfortunately defaults all other events to failure. I'm hoping to devise a way to ultimately create the action field and have it translate to success when vendor_action is equal to Passed_Authentications and failure when vendor_action is equal to Failed_Attemps and disregard all other vendor_action values.

Any help would be much appreciated!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try case. This example sets action to "success" and "failure" as you want. Other values for vendor_action will assign NULL to action.

index=index sourcetype=sourcetype | eval action=case(vendor_action == "Passed_Authentications", "success", vendor_action=="Failed_Attempts", "failure") 
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try case. This example sets action to "success" and "failure" as you want. Other values for vendor_action will assign NULL to action.

index=index sourcetype=sourcetype | eval action=case(vendor_action == "Passed_Authentications", "success", vendor_action=="Failed_Attempts", "failure") 
---
If this reply helps you, Karma would be appreciated.
0 Karma

SMWickman
Explorer

Thank you very much!!!

0 Karma
Get Updates on the Splunk Community!

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...