Splunk Search

How can I eval a new field using only partial values from existing field?

Explorer

Apologies if my question's title is non-descriptive. I am working through extracting an 'action' field from an existing values in the vendor_action field. Right now, there are multiple value results in the field 'vendor_action' and I'm looking to limit those results to only 2.

vendor_action field has values of "Radius Accounting, Passed_Authentications, Failed_Attempts, Administrative_and_Operational Audit.. etc.. etc..

I'm trying to just focus on "Passed_Authentications, and Failed_Attempts" and ultimately eval 'success' and 'failure' as the values of the action field. This is where I've gotten so far:

index=index sourcetype=sourcetype | eval action=if(vendor_action == "Passed_Authentications", "success", "failure") - this successfully extracts the action field and gives me 'success' where 'Passed_Authentications' is found but unfortunately defaults all other events to failure. I'm hoping to devise a way to ultimately create the action field and have it translate to success when vendor_action is equal to Passed_Authentications and failure when vendor_action is equal to Failed_Attemps and disregard all other vendor_action values.

Any help would be much appreciated!

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try case. This example sets action to "success" and "failure" as you want. Other values for vendor_action will assign NULL to action.

index=index sourcetype=sourcetype | eval action=case(vendor_action == "Passed_Authentications", "success", vendor_action=="Failed_Attempts", "failure") 
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try case. This example sets action to "success" and "failure" as you want. Other values for vendor_action will assign NULL to action.

index=index sourcetype=sourcetype | eval action=case(vendor_action == "Passed_Authentications", "success", vendor_action=="Failed_Attempts", "failure") 
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Explorer

Thank you very much!!!

0 Karma