Splunk Search

How to evaluate multiple fields and replace field output with new string

garciajbg
Explorer

I have an issue where events are displaying incorrect information for a particular field in my search.

Example:

mySearch | table field 1, field 2, field 3, field 4, field 5, field 6, field 7

My problem is fields 4, 6, and 7 somewhat correspond with one another.

field 5 = errorCode
field 6 = errorMessage
field 7 = output string

If "field 5" = success ----------then "field 6" is null----------- and "field 7" shows the correct output string
HOWEVER
If "field 5" = an error code------- then "field 6" will show the error message-------BUT "field 7" shows the incorrect output string

What I am trying to do is evaluate "field 5", and if "Field 5" equals anything other than "success" string then "field 7" will equal a new string of my choice. If "field 5" equals "success" than leave "field 7" alone.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Here's one way to do that.

... | eval field7 = if(field5="success", field7, "string of my choice")
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's one way to do that.

... | eval field7 = if(field5="success", field7, "string of my choice")
---
If this reply helps you, Karma would be appreciated.
0 Karma

garciajbg
Explorer

richgalloway,

So I was able to correct any issues by first renaming field 7 to something simple with no periods, spaces, etc. Once I did that and ran the search with the eval it worked as I wanted it to. Thanks!

0 Karma

garciajbg
Explorer

Richagalloway,

I’ve tried this already but I can’t seem to get field 7 to show its default string. In the example given field 7 would show the name of field 7 rather than its original string if the search was run without the eval.

For example, ran WITHOUT “eval” listed above.
Field 5 Field 6 Field 7
Success null success
Error ErrroMSG success

Where field 5 shows the incorrect field 7 string

For example WITH “eval” listed above
Field 5 Field 6 Field 7
Success null Field 7
Error ErrorMSG MyString

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share your query.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...