Splunk Search

How to have Field Values represent other field values?

thomastaylor
Communicator

Hello all!

I apologize for the oddly worded question. Currently, I have extracted fields from two separate log formats that provide different spellings of field values.

Examples:

Field Name: Status
Field Values: ERROR, INFO, CRITICAL, err, info

Since info and INFO are not the same string, this will provide two different metrics to work with. I would like to know if there is someway to merge the "info" into the "INFO" so that it's only seen as one metric. The same applies with err to ERROR as well. And, if there is no way to do this other than by a saved search, I can do that as well. Just let me know!

Thanks you so much for your time!

0 Karma
1 Solution

thomastaylor
Communicator

Thank you for your answer!

We actually found a work-around solution where we tagged the statuses as "INFO" and "ERROR" for all the different log formats. We then did the search: index="main" | timechart count by tag::status and it achieved what we wanted.

View solution in original post

TISKAR
Builder

Hello,

You can use the tag or alias in Splunk, that acn help you to manage and organise your data

Regards

0 Karma

thomastaylor
Communicator

Thank you for your answer!

We actually found a work-around solution where we tagged the statuses as "INFO" and "ERROR" for all the different log formats. We then did the search: index="main" | timechart count by tag::status and it achieved what we wanted.

somesoni2
SplunkTrust
SplunkTrust

This is a great solution for problems like this. I've converted your comment as Answer so that you can accept this. Others with similar problem would then know that a working solution is available.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Do the distinct field Values are finite list? If yes, you can add a case statement in your search to normalize the values. e.g.

...| eval Status=case(match(Status,"^(?i)(ERR)"),"ERROR",match(Status,"^(?i)(INFO)"),"INFO",..other values )
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...