Splunk Search

How to rename an operation field which is being computed from json (message log)?

Anu1184
Explorer

I am retrieving operation details like operation name, total time etc from json message log coming as a part of splunk search event.  I want to have a custom name of the operation which was extracted from json data.

Current Result:-

Operation Total time
PREDICT: A1: B1: C1 100
PREDICT: A2: B2: C2 200
PREDICT: A3: B3: C3 300
PREDICT: A4: B4: C4 400



Expected Result:-

Operation Total time
Service_A1 100
Service_A2 200
Service_A3 300
Service_A4 400
Labels (1)
Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Anu1184,

if the expected values for OPeration are in a limitated and fixed number of values, you can use eval case to rename them at the end of your search:

| eval Operation=case(Operation="PREDICT: A1: B1: C1","Service_A1", Operation="PREDICT: A2: B2: C2","Service_A2", Operation="PREDICT: A3: B3: C3", "Service_A3", Operation="PREDICT: A4: B4: C4","Service_A4")

Ciao.

Giuseppe

View solution in original post

Anu1184
Explorer

Thank You!!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Anu1184,

if the expected values for OPeration are in a limitated and fixed number of values, you can use eval case to rename them at the end of your search:

| eval Operation=case(Operation="PREDICT: A1: B1: C1","Service_A1", Operation="PREDICT: A2: B2: C2","Service_A2", Operation="PREDICT: A3: B3: C3", "Service_A3", Operation="PREDICT: A4: B4: C4","Service_A4")

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...