How to have Field Values represent other field values?

[thomastaylor]

Hello all!

I apologize for the oddly worded question. Currently, I have extracted fields from two separate log formats that provide different spellings of field values.

Examples:

Field Name: Status
Field Values: ERROR, INFO, CRITICAL, err, info

Since info and INFO are not the same string, this will provide two different metrics to work with. I would like to know if there is someway to merge the "info" into the "INFO" so that it's only seen as one metric. The same applies with err to ERROR as well. And, if there is no way to do this other than by a saved search, I can do that as well. Just let me know!

Thanks you so much for your time!

[TISKAR]

Hello,

You can use the tag or alias in Splunk, that acn help you to manage and organise your data

Regards

[thomastaylor · Accepted solution]

Thank you for your answer!

We actually found a work-around solution where we tagged the statuses as "INFO" and "ERROR" for all the different log formats. We then did the search: index="main" | timechart count by tag::status and it achieved what we wanted.

[somesoni2]

This is a great solution for problems like this. I've converted your comment as Answer so that you can accept this. Others with similar problem would then know that a working solution is available.

[somesoni2]

Do the distinct field Values are finite list? If yes, you can add a case statement in your search to normalize the values. e.g.

...| eval Status=case(match(Status,"^(?i)(ERR)"),"ERROR",match(Status,"^(?i)(INFO)"),"INFO",..other values )