Splunk Search

How to evaluate to Field Value SPL?

mohsplunking
Explorer

Hello Splunkers,

I need some help with writing a SPL, I have a field  called "DcPolicyAction" where the value could be 0 or 1, if its 0 I want to basically call it Successful and If its 1 it is Failure , can someone help me with the SPL syntax.  I dont want to use the stats command. Just a simple query that lists the field.

 

Thank you,

 

regards,

Moh.

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval DcActionValue=if(DcActionValue=0,"Successful","Failure")

View solution in original post

0 Karma

mohsplunking
Explorer

Thanks ITWHisperer , Much Appreciated !

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval DcActionValue=if(DcActionValue=0,"Successful","Failure")
0 Karma
Get Updates on the Splunk Community!

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...