Splunk Search

How to evaluate multiple fields and replace field output with new string

garciajbg
Explorer

I have an issue where events are displaying incorrect information for a particular field in my search.

Example:

mySearch | table field 1, field 2, field 3, field 4, field 5, field 6, field 7

My problem is fields 4, 6, and 7 somewhat correspond with one another.

field 5 = errorCode
field 6 = errorMessage
field 7 = output string

If "field 5" = success ----------then "field 6" is null----------- and "field 7" shows the correct output string
HOWEVER
If "field 5" = an error code------- then "field 6" will show the error message-------BUT "field 7" shows the incorrect output string

What I am trying to do is evaluate "field 5", and if "Field 5" equals anything other than "success" string then "field 7" will equal a new string of my choice. If "field 5" equals "success" than leave "field 7" alone.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Here's one way to do that.

... | eval field7 = if(field5="success", field7, "string of my choice")
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's one way to do that.

... | eval field7 = if(field5="success", field7, "string of my choice")
---
If this reply helps you, Karma would be appreciated.
0 Karma

garciajbg
Explorer

richgalloway,

So I was able to correct any issues by first renaming field 7 to something simple with no periods, spaces, etc. Once I did that and ran the search with the eval it worked as I wanted it to. Thanks!

0 Karma

garciajbg
Explorer

Richagalloway,

I’ve tried this already but I can’t seem to get field 7 to show its default string. In the example given field 7 would show the name of field 7 rather than its original string if the search was run without the eval.

For example, ran WITHOUT “eval” listed above.
Field 5 Field 6 Field 7
Success null success
Error ErrroMSG success

Where field 5 shows the incorrect field 7 string

For example WITH “eval” listed above
Field 5 Field 6 Field 7
Success null Field 7
Error ErrorMSG MyString

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share your query.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...

Want to Reduce Costs, Mitigate Risk, Improve Performance, or Increase Efficiencies? ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...