Splunk Search

How can I eval a new field using only partial values from existing field?

Explorer

Apologies if my question's title is non-descriptive. I am working through extracting an 'action' field from an existing values in the vendor_action field. Right now, there are multiple value results in the field 'vendor_action' and I'm looking to limit those results to only 2.

vendor_action field has values of "Radius Accounting, Passed_Authentications, Failed_Attempts, Administrative_and_Operational Audit.. etc.. etc..

I'm trying to just focus on "Passed_Authentications, and Failed_Attempts" and ultimately eval 'success' and 'failure' as the values of the action field. This is where I've gotten so far:

index=index sourcetype=sourcetype | eval action=if(vendor_action == "Passed_Authentications", "success", "failure") - this successfully extracts the action field and gives me 'success' where 'Passed_Authentications' is found but unfortunately defaults all other events to failure. I'm hoping to devise a way to ultimately create the action field and have it translate to success when vendor_action is equal to Passed_Authentications and failure when vendor_action is equal to Failed_Attemps and disregard all other vendor_action values.

Any help would be much appreciated!

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try case. This example sets action to "success" and "failure" as you want. Other values for vendor_action will assign NULL to action.

index=index sourcetype=sourcetype | eval action=case(vendor_action == "Passed_Authentications", "success", vendor_action=="Failed_Attempts", "failure") 
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try case. This example sets action to "success" and "failure" as you want. Other values for vendor_action will assign NULL to action.

index=index sourcetype=sourcetype | eval action=case(vendor_action == "Passed_Authentications", "success", vendor_action=="Failed_Attempts", "failure") 
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Explorer

Thank you very much!!!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!