Splunk Search
Highlighted

How to edit my search to change the output of certain strings in results?

Path Finder

Hi Helpful People,

I have a table which tells me perfectly well who is logged in to systems. My results show the words "Opened" and "Closed". I wish for them to say "In" or "Out" instead. Is there anyway that I can achieve this so that my results are more readable. My search is as follows:

host=?? NOT host=?? NOT host=?? NOT username=?? NOT username= ?? NOT username= ?? NOT username=?? "Session opened" OR "Session closed" | sort username time | chart latest(lstate) over username by host.
0 Karma
Highlighted

Re: How to edit my search to change the output of certain strings in results?

SplunkTrust
SplunkTrust

You can use replace command for that. http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Replace

host=?? NOT host=?? NOT host=?? NOT username=?? NOT username= ?? NOT username= ?? NOT username=?? "Session opened" OR "Session closed" | sort username time | chart latest(lstate) over username by host | replace "Opened" with "In" "Closed" with "Out" in *

View solution in original post

0 Karma
Highlighted

Re: How to edit my search to change the output of certain strings in results?

Path Finder

Thank you so much!! I remember doing this a while back but had totally forgotten. Thanks for reminding me

0 Karma