Splunk Search

How to evaluate multiple fields and replace field output with new string

garciajbg
Explorer

I have an issue where events are displaying incorrect information for a particular field in my search.

Example:

mySearch | table field 1, field 2, field 3, field 4, field 5, field 6, field 7

My problem is fields 4, 6, and 7 somewhat correspond with one another.

field 5 = errorCode
field 6 = errorMessage
field 7 = output string

If "field 5" = success ----------then "field 6" is null----------- and "field 7" shows the correct output string
HOWEVER
If "field 5" = an error code------- then "field 6" will show the error message-------BUT "field 7" shows the incorrect output string

What I am trying to do is evaluate "field 5", and if "Field 5" equals anything other than "success" string then "field 7" will equal a new string of my choice. If "field 5" equals "success" than leave "field 7" alone.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Here's one way to do that.

... | eval field7 = if(field5="success", field7, "string of my choice")
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's one way to do that.

... | eval field7 = if(field5="success", field7, "string of my choice")
---
If this reply helps you, Karma would be appreciated.
0 Karma

garciajbg
Explorer

richgalloway,

So I was able to correct any issues by first renaming field 7 to something simple with no periods, spaces, etc. Once I did that and ran the search with the eval it worked as I wanted it to. Thanks!

0 Karma

garciajbg
Explorer

Richagalloway,

I’ve tried this already but I can’t seem to get field 7 to show its default string. In the example given field 7 would show the name of field 7 rather than its original string if the search was run without the eval.

For example, ran WITHOUT “eval” listed above.
Field 5 Field 6 Field 7
Success null success
Error ErrroMSG success

Where field 5 shows the incorrect field 7 string

For example WITH “eval” listed above
Field 5 Field 6 Field 7
Success null Field 7
Error ErrorMSG MyString

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share your query.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...