Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to write a search to display a particular ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If AVSResponse = x, then I need to display "matched" in the dashboard report. Likewise, if I have more than 10 value to be matched. Kindly help how I can set up the ssearch. thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you tried if or case from http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/Commonevalfunctions
Eg:
... | eval description=case(error == 404, "Not found", error == 500, "Internal Server Error", error == 200, "OK")
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you tried if or case from http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/Commonevalfunctions
Eg:
... | eval description=case(error == 404, "Not found", error == 500, "Internal Server Error", error == 200, "OK")
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Looks great. Just tried something like -
index=iiii | eval cat=case(host == "aaaa", "customer", host == "bbbb", "customer") and it works.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Be sure to accept renjith.nair's answer of it worked for you. That way people can see what to do.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@ ddrillic & Renjith.nair , thanks alot for sharing your knowledge. Great support ! executed the query successfully .
What the End of Support for Splunk Add-on Builder Means for You
Solve, Learn, Repeat: New Puzzle Channel Now Live
Building Reliable Asset and Identity Frameworks in Splunk ES
