Splunk Search

How to evaluate to Field Value SPL?

mohsplunking
Explorer

Hello Splunkers,

I need some help with writing a SPL, I have a field  called "DcPolicyAction" where the value could be 0 or 1, if its 0 I want to basically call it Successful and If its 1 it is Failure , can someone help me with the SPL syntax.  I dont want to use the stats command. Just a simple query that lists the field.

 

Thank you,

 

regards,

Moh.

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval DcActionValue=if(DcActionValue=0,"Successful","Failure")

View solution in original post

0 Karma

mohsplunking
Explorer

Thanks ITWHisperer , Much Appreciated !

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval DcActionValue=if(DcActionValue=0,"Successful","Failure")
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...