Splunk Search

How to have Field Values represent other field values?

thomastaylor
Communicator

Hello all!

I apologize for the oddly worded question. Currently, I have extracted fields from two separate log formats that provide different spellings of field values.

Examples:

Field Name: Status
Field Values: ERROR, INFO, CRITICAL, err, info

Since info and INFO are not the same string, this will provide two different metrics to work with. I would like to know if there is someway to merge the "info" into the "INFO" so that it's only seen as one metric. The same applies with err to ERROR as well. And, if there is no way to do this other than by a saved search, I can do that as well. Just let me know!

Thanks you so much for your time!

0 Karma
1 Solution

thomastaylor
Communicator

Thank you for your answer!

We actually found a work-around solution where we tagged the statuses as "INFO" and "ERROR" for all the different log formats. We then did the search: index="main" | timechart count by tag::status and it achieved what we wanted.

View solution in original post

TISKAR
Builder

Hello,

You can use the tag or alias in Splunk, that acn help you to manage and organise your data

Regards

0 Karma

thomastaylor
Communicator

Thank you for your answer!

We actually found a work-around solution where we tagged the statuses as "INFO" and "ERROR" for all the different log formats. We then did the search: index="main" | timechart count by tag::status and it achieved what we wanted.

somesoni2
Revered Legend

This is a great solution for problems like this. I've converted your comment as Answer so that you can accept this. Others with similar problem would then know that a working solution is available.

0 Karma

somesoni2
Revered Legend

Do the distinct field Values are finite list? If yes, you can add a case statement in your search to normalize the values. e.g.

...| eval Status=case(match(Status,"^(?i)(ERR)"),"ERROR",match(Status,"^(?i)(INFO)"),"INFO",..other values )
0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...