Splunk Search

How to create an eval on random data string ?

mah
Builder

Hi,

My issue is : I want to create a field from random data string (always the same) which is not present in all logs.

The objective is to create a table with a first column which lists all value of "log-group" field AND a second column with binary value which is to say if the random string is present in the log so 1 if not 0  : 

log-groupstring presence
test1 1
test2 0
test3 1

For example, my log : 

log-group=test1 2020-07-09 13:28:38 [pool] INFO test : received from test analytics.measure.record topic: 0 objects random data string

log-group=test2 2020-07-09 13:28:38 [pool] INFO test : received from test analytics.measure.record topic: 0 objects 

log-group=test3 2020-07-09 13:28:38 [pool] INFO test : received from test analytics.measure.record topic: 0 objects random data string

How can I do that ? 

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @mah ,

good!

for the other people of Community, if this answer solves your need, please accept solution and eventually Karma Points are appreciated.

Ciao and next time.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mah ,

you should try something like this:

index=your_index
| eval string_presence=if(searchmatch(random_data_string),"1","0")
| table log_group string_presence 

Ciao.

Giuseppe

mah
Builder

Exactly what I needed !  Thanks 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mah ,

good!

for the other people of Community, if this answer solves your need, please accept solution and eventually Karma Points are appreciated.

Ciao and next time.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...