Splunk Search

How to rename an operation field which is being computed from json (message log)?

Anu1184
Explorer

I am retrieving operation details like operation name, total time etc from json message log coming as a part of splunk search event.  I want to have a custom name of the operation which was extracted from json data.

Current Result:-

Operation Total time
PREDICT: A1: B1: C1 100
PREDICT: A2: B2: C2 200
PREDICT: A3: B3: C3 300
PREDICT: A4: B4: C4 400



Expected Result:-

Operation Total time
Service_A1 100
Service_A2 200
Service_A3 300
Service_A4 400
Labels (1)
Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Anu1184,

if the expected values for OPeration are in a limitated and fixed number of values, you can use eval case to rename them at the end of your search:

| eval Operation=case(Operation="PREDICT: A1: B1: C1","Service_A1", Operation="PREDICT: A2: B2: C2","Service_A2", Operation="PREDICT: A3: B3: C3", "Service_A3", Operation="PREDICT: A4: B4: C4","Service_A4")

Ciao.

Giuseppe

View solution in original post

Anu1184
Explorer

Thank You!!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Anu1184,

if the expected values for OPeration are in a limitated and fixed number of values, you can use eval case to rename them at the end of your search:

| eval Operation=case(Operation="PREDICT: A1: B1: C1","Service_A1", Operation="PREDICT: A2: B2: C2","Service_A2", Operation="PREDICT: A3: B3: C3", "Service_A3", Operation="PREDICT: A4: B4: C4","Service_A4")

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...