Splunk Search

How to replace a status with a new value?

_gkollias
SplunkTrust
SplunkTrust

I have search I'm running to change the status of a particular error that is a false negative:

index=wertyu sourcetype=audit  "No valid format *"
| eval status = if(other=="No valid format*","SUCCESS",status)
| stats count latest(status) as status, latest(other) as other by FOO

I'm still seeing FAILED as the status rather than success, and am not quite sure what's wrong here.

Any insights would be greatly appreciated.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I'm not sure why you're testing to see if "No valid format" is present when you've told Splunk to only return events with that text.
That said, try this.

... | eval status = if(match(other,"No valid format%"),"SUCCESS",status) | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I'm not sure why you're testing to see if "No valid format" is present when you've told Splunk to only return events with that text.
That said, try this.

... | eval status = if(match(other,"No valid format%"),"SUCCESS",status) | ...
---
If this reply helps you, an upvote would be appreciated.

_gkollias
SplunkTrust
SplunkTrust

Yes! This worked:

index=wertyu sourcetype=audit  "No valid format*" earliest=-5d
 | eval status = if(match(other,"No valid format\.*"),"SUCCESS",status)  
 | stats count latest(status) as status, latest(other) as other by FOO

Thank you!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Glad to hear it. Please accept the answer.

---
If this reply helps you, an upvote would be appreciated.

_gkollias
SplunkTrust
SplunkTrust

Sure thing - here is a friendly sample of the log file:

2015-11-04T13:20:34.319 -0500,1,{host=host},{BP|InvoiceAudit|STATUS ,[CODE]::No valid format for FOO.-

We use extractions before parsing the data, so any string in that placement is stored in the other field.

Also, we know it works since I am able to populate the results in the searches above. The weird thing here is that the status isn't changing.

Any thoughts?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I confused the match syntax with the like syntax. One of these should work for you.

... | eval status = if(like(other,"No valid format%"),"SUCCESS",status) | ...

or

... | eval status = if(match(other,"No valid format\.*"),"SUCCESS",status) | ...
---
If this reply helps you, an upvote would be appreciated.

_gkollias
SplunkTrust
SplunkTrust

Thanks - I am testing to make sure that the search results are accurate before broadening the scope of the search. Why not test this on data I know should give me what I would expect first?

Unfortunately, I am still seeing FAILED as status rather than SUCCESS:

index=wertyu sourcetype=audit  "No valid format*"
| stats count latest(status) as status, latest(other) as other by FOO
| eval status = if(match(other,"No valid format%"),"SUCCESS",status)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Can we see a sample of your data? Have you verified the other field contains the target text?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

clorne
Path Finder

Hello
No valid format * is different from No valid format* (there is no blank between the t and *).

Regards

0 Karma

_gkollias
SplunkTrust
SplunkTrust

Thanks - this did not make a difference in the results.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

It will not make a different as long as a non-word character is trailing. Those are caught as punctuations. But remember, you might not notice that its no difference, but the result set could be different.

For example:
"no valid format" will match results that contain the string "no valid format/" but not "no valid format ".

Make sense?

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...