Splunk Search

How to change a field with a numeric value in a CSV input file to a word equivalent at index-time?

corosco112
New Member

For example, csv field is vulnerability severity (range of 1-10). I want to change that to one of 3 values depending on the numeric value, Moderate, Severe or Critical. I read that Lookup files cannot be used at index-time, so is there an alternative?

0 Karma

sundareshr
Legend

There are a couple of options

If you must do it at index time, you can use SEDCMD in your props.con to anonymize your data. See online documentation for more details1. The limitation with this howeever, is you cannot use INDEXED_EXTRACTIONS to extract your csv data. You will have to import them as DELIM and specify FIELD names in your transforms.

The other option, would be to create a calculated field. This will add a new field that can be used in your searches. Read up on that here http://docs.splunk.com/Documentation/Splunk/6.1/Knowledge/definecalcfields

0 Karma

corosco112
New Member

OK thanks. Right now I'm trying to create an automatic lookup to use at search time. But I'll try the calculated field method.

0 Karma

marina_rovira
Contributor

Hi there!

If I am understanding this correctly, you have a field called severity and with a range values 1-10, and depending the number, you want to change it to Moderate, Severe or Critical and use it after the change in another search, right?

If this is the case, you could try something like this:
| eval priority= if(severity(your field)>="0" AND severity<5, "Moderate", if (severity <"8" AND severity >= "5", "Severe", if (severity <= "10" AND severity >= 8, "Critical","Unrated")))

This will set a new field called priority the values 0-4 as Moderate, values from 5-8 SEvere and values from 8-10 Critical.

I hope It works, If I am missunderstanding something or it doesn't work write it and I will try to help you more 🙂

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...