Splunk Search

How to change a field with a numeric value in a CSV input file to a word equivalent at index-time?

corosco112
New Member

For example, csv field is vulnerability severity (range of 1-10). I want to change that to one of 3 values depending on the numeric value, Moderate, Severe or Critical. I read that Lookup files cannot be used at index-time, so is there an alternative?

0 Karma

sundareshr
Legend

There are a couple of options

If you must do it at index time, you can use SEDCMD in your props.con to anonymize your data. See online documentation for more details1. The limitation with this howeever, is you cannot use INDEXED_EXTRACTIONS to extract your csv data. You will have to import them as DELIM and specify FIELD names in your transforms.

The other option, would be to create a calculated field. This will add a new field that can be used in your searches. Read up on that here http://docs.splunk.com/Documentation/Splunk/6.1/Knowledge/definecalcfields

0 Karma

corosco112
New Member

OK thanks. Right now I'm trying to create an automatic lookup to use at search time. But I'll try the calculated field method.

0 Karma

marina_rovira
Contributor

Hi there!

If I am understanding this correctly, you have a field called severity and with a range values 1-10, and depending the number, you want to change it to Moderate, Severe or Critical and use it after the change in another search, right?

If this is the case, you could try something like this:
| eval priority= if(severity(your field)>="0" AND severity<5, "Moderate", if (severity <"8" AND severity >= "5", "Severe", if (severity <= "10" AND severity >= 8, "Critical","Unrated")))

This will set a new field called priority the values 0-4 as Moderate, values from 5-8 SEvere and values from 8-10 Critical.

I hope It works, If I am missunderstanding something or it doesn't work write it and I will try to help you more 🙂

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...