Splunk Search

How to create an eval on random data string ?

mah
Builder

Hi,

My issue is : I want to create a field from random data string (always the same) which is not present in all logs.

The objective is to create a table with a first column which lists all value of "log-group" field AND a second column with binary value which is to say if the random string is present in the log so 1 if not 0  : 

log-groupstring presence
test1 1
test2 0
test3 1

For example, my log : 

log-group=test1 2020-07-09 13:28:38 [pool] INFO test : received from test analytics.measure.record topic: 0 objects random data string

log-group=test2 2020-07-09 13:28:38 [pool] INFO test : received from test analytics.measure.record topic: 0 objects 

log-group=test3 2020-07-09 13:28:38 [pool] INFO test : received from test analytics.measure.record topic: 0 objects random data string

How can I do that ? 

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @mah ,

good!

for the other people of Community, if this answer solves your need, please accept solution and eventually Karma Points are appreciated.

Ciao and next time.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mah ,

you should try something like this:

index=your_index
| eval string_presence=if(searchmatch(random_data_string),"1","0")
| table log_group string_presence 

Ciao.

Giuseppe

mah
Builder

Exactly what I needed !  Thanks :winking_face:

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mah ,

good!

for the other people of Community, if this answer solves your need, please accept solution and eventually Karma Points are appreciated.

Ciao and next time.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...