Splunk Search
Highlighted

How to edit my search to calculate a field?

Path Finder

Hi,

I am trying to calculate a field from a data that I receive from a vulnerability system.

severity field returns "unknown" which screws my dashboards.

I want to eval a field `'category' and if it equals INFO, set field 'severity' to Informational

search ... |  eval severity=if(category,"INFO","Informational")
0 Karma
Highlighted

Re: How to edit my search to calculate a field?

Path Finder

Ok I got here....

| eval severity=if(category=="INFO","informational", " ")

What should my last argument be if I want the severity to stay unmodified if it does not equal INFO ?

0 Karma
Highlighted

Re: How to edit my search to calculate a field?

Motivator

Try to assign it back to itself then if u want it to stay unmodified:

| eval severity=if(category=="INFO","informational", severity)

View solution in original post

0 Karma
Highlighted

Re: How to edit my search to calculate a field?

Path Finder

Thanks all. This is working exactly how I wanted it to work.

0 Karma
Highlighted

Re: How to edit my search to calculate a field?

Communicator

Try this out:
search ... | eval severity=case(match(category,"INFO"), "Informational", severity)

0 Karma