Splunk Search

How to rename an operation field which is being computed from json (message log)?

Anu1184
Explorer

I am retrieving operation details like operation name, total time etc from json message log coming as a part of splunk search event.  I want to have a custom name of the operation which was extracted from json data.

Current Result:-

Operation Total time
PREDICT: A1: B1: C1 100
PREDICT: A2: B2: C2 200
PREDICT: A3: B3: C3 300
PREDICT: A4: B4: C4 400



Expected Result:-

Operation Total time
Service_A1 100
Service_A2 200
Service_A3 300
Service_A4 400
Labels (1)
Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Anu1184,

if the expected values for OPeration are in a limitated and fixed number of values, you can use eval case to rename them at the end of your search:

| eval Operation=case(Operation="PREDICT: A1: B1: C1","Service_A1", Operation="PREDICT: A2: B2: C2","Service_A2", Operation="PREDICT: A3: B3: C3", "Service_A3", Operation="PREDICT: A4: B4: C4","Service_A4")

Ciao.

Giuseppe

View solution in original post

Anu1184
Explorer

Thank You!!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Anu1184,

if the expected values for OPeration are in a limitated and fixed number of values, you can use eval case to rename them at the end of your search:

| eval Operation=case(Operation="PREDICT: A1: B1: C1","Service_A1", Operation="PREDICT: A2: B2: C2","Service_A2", Operation="PREDICT: A3: B3: C3", "Service_A3", Operation="PREDICT: A4: B4: C4","Service_A4")

Ciao.

Giuseppe

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...