Splunk Search

How do you store field names as values in a new field based on presence of that field?

Explorer

Say I have 100 rows of logs. Some have only field "abcXYZ1" and not the other two. Some have field "abcKLM" and not the other two and so on...

So occurrence of fields "abc*" is mutually exclusive.

Now based on this, I want to add another field EVENT which will look if that log has field "abcXYZ1" then value of EVENT = abcXYZ1, if a log has field "abcKLM" then EVENT=abcKLM and so on...

So looking at a log and finding which type of field it has based on "abc*" , only that fields name will be stored as a value in the new field EVENT.

Hope it is clear to understand.

Tags (2)
0 Karma

SplunkTrust
SplunkTrust
0 Karma

Explorer

Updates answer also works like a charm. Thanks for the help..

0 Karma