Splunk Search

How would I examine a field and set another field based upon that value?

a212830
Champion

Hi,

I have some hosts that follow naming conventions and I want to create and set another field based upon those naming conventions. How would I do that? For example, some of these hosts have "MMK" in them, and others have "RTP". I want to check for those values, and if they exists, set another field "location" to a literal string value representing those locations. Eval? Where?

Amohlmann
Communicator

You could use either eval or rex to do this. As others have already provided you with the answer for using an eval, a regular expression query would look like this:

Base Search
| rex field=hosts "(?<location>MMK|RTP).*"

The regular expression can be tidied up a bit more if you gave an example of your events.

lguinn2
Legend

You are on the right track; eval can do what you need, like this

yoursearchhere
| eval location=case(host LIKE "%MMK%","MMK", host LIKE "%RTP%", "RTP", 1==1, "Other")
| stats count by location

I used the case function, but there are other ways to do this as well.

You might also consider a lookup table, which could provide more information about your hosts:

host_list.csv
host,location,dept,ip
mmk01,"San Francisco",Finance,10.12.14.122
rtp03,Durham,Finance,10.72.24.214
etc.

Here is a tutorial on lookup tables.

0 Karma

Murali2888
Communicator

you can use eval and searchmatch
| eval location= if(searchmatch("MMK"),"LiteralString1",if(searchmatch("RTP"),"LiteralString2","DEFAULTStr"))

0 Karma

renjith_nair
Legend

Try this

Your search |eval location=case(host LIKE "%MMK%", "MMKLOCATION", host LIKE "%RTP%", "RTPLOCATION", host LIKE "%", "Others")
---
What goes around comes around. If it helps, hit it with Karma 🙂

a212830
Champion

Thanks! !!!

0 Karma

renjith_nair
Legend

No problem. Please mark as answer if it's resolved so that thread will be closed!

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

renjith_nair
Legend

@a212830 , if the answer helps you, please mark as answer. Thanks

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...