Splunk Search

How do I convert values returned to another format?

djconroy
Path Finder

Is there a way when creating a table of syslog results that I can convert a value such as "17" to "udp" based on a set of predefined mappings, i.e. 1=icmp,6=tcp,17=udp,47=gre,50=esp?

Thanks!

Tags (2)
0 Karma
1 Solution

mcmaster
Communicator

You're probably looking for something like this:

http://docs.splunk.com/Documentation/Splunk/6.0.3/Knowledge/Addfieldsfromexternaldatasources

You'll want to define a CSV with the protocol number as one column, and the protocol name as the other. You can then use that in a lookup something like (not exact as you didn't provide details on your logs):

sourcetype=my-firewall | lookup protocols protocol_number OUTPUT protocol_name

You can see more on using the lookup command here:

http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/Lookup

View solution in original post

mcmaster
Communicator

You're probably looking for something like this:

http://docs.splunk.com/Documentation/Splunk/6.0.3/Knowledge/Addfieldsfromexternaldatasources

You'll want to define a CSV with the protocol number as one column, and the protocol name as the other. You can then use that in a lookup something like (not exact as you didn't provide details on your logs):

sourcetype=my-firewall | lookup protocols protocol_number OUTPUT protocol_name

You can see more on using the lookup command here:

http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/Lookup

somesoni2
Revered Legend

Lookups comes very handy for situations where additional static information to be added to result. Also, if the no of mapping is small and its to be used in only 1-2 places, you can use "eval-case" command to define those. [lookups are easily scalable though]

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...