Splunk Search

How to change status of the above message to success status?

Renunaren
Loves-to-Learn Everything

I have a message in my events like below

"Main function executed successfully."

I need to change status of the above message to Success status.

Labels (1)
0 Karma

batabay
Path Finder

Also you can try this ; 

| eval status = if(match(_raw,"Main function executed successfully. "),"Success","No Sucess Message")
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Do you mean to assign a value to a field named "status"?  Like

| eval status = if(match("Main function executed successfully", "Success", null())
Tags (1)
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...