Splunk Search

How to evaluate multiple fields and replace field output with new string

Explorer

I have an issue where events are displaying incorrect information for a particular field in my search.

Example:

mySearch | table field 1, field 2, field 3, field 4, field 5, field 6, field 7

My problem is fields 4, 6, and 7 somewhat correspond with one another.

field 5 = errorCode
field 6 = errorMessage
field 7 = output string

If "field 5" = success ----------then "field 6" is null----------- and "field 7" shows the correct output string
HOWEVER
If "field 5" = an error code------- then "field 6" will show the error message-------BUT "field 7" shows the incorrect output string

What I am trying to do is evaluate "field 5", and if "Field 5" equals anything other than "success" string then "field 7" will equal a new string of my choice. If "field 5" equals "success" than leave "field 7" alone.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Here's one way to do that.

... | eval field7 = if(field5="success", field7, "string of my choice")
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Here's one way to do that.

... | eval field7 = if(field5="success", field7, "string of my choice")
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Explorer

richgalloway,

So I was able to correct any issues by first renaming field 7 to something simple with no periods, spaces, etc. Once I did that and ran the search with the eval it worked as I wanted it to. Thanks!

0 Karma

Explorer

Richagalloway,

I’ve tried this already but I can’t seem to get field 7 to show its default string. In the example given field 7 would show the name of field 7 rather than its original string if the search was run without the eval.

For example, ran WITHOUT “eval” listed above.
Field 5 Field 6 Field 7
Success null success
Error ErrroMSG success

Where field 5 shows the incorrect field 7 string

For example WITH “eval” listed above
Field 5 Field 6 Field 7
Success null Field 7
Error ErrorMSG MyString

0 Karma

SplunkTrust
SplunkTrust

Please share your query.

---
If this reply helps you, an upvote would be appreciated.
0 Karma