Splunk Search

How to evaluate to Field Value SPL?

mohsplunking
Path Finder

Hello Splunkers,

I need some help with writing a SPL, I have a field  called "DcPolicyAction" where the value could be 0 or 1, if its 0 I want to basically call it Successful and If its 1 it is Failure , can someone help me with the SPL syntax.  I dont want to use the stats command. Just a simple query that lists the field.

 

Thank you,

 

regards,

Moh.

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval DcActionValue=if(DcActionValue=0,"Successful","Failure")

View solution in original post

0 Karma

mohsplunking
Path Finder

Thanks ITWHisperer , Much Appreciated !

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval DcActionValue=if(DcActionValue=0,"Successful","Failure")
0 Karma
Get Updates on the Splunk Community!

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Community Feedback

We Want to Hear from You! Share Your Feedback on the Splunk Community   The Splunk Community is built for you ...

Manual Instrumentation with Splunk Observability Cloud: Implementing the ...

In our observability journey so far, we've built comprehensive instrumentation for our Worms in Space ...