How would I examine a field and set another field based upon that value?

[a212830]

Hi,

I have some hosts that follow naming conventions and I want to create and set another field based upon those naming conventions. How would I do that? For example, some of these hosts have "MMK" in them, and others have "RTP". I want to check for those values, and if they exists, set another field "location" to a literal string value representing those locations. Eval? Where?

[Amohlmann]

You could use either eval or rex to do this. As others have already provided you with the answer for using an eval, a regular expression query would look like this:

Base Search
| rex field=hosts "(?<location>MMK|RTP).*"

The regular expression can be tidied up a bit more if you gave an example of your events.

[lguinn2]

You are on the right track; eval can do what you need, like this

yoursearchhere
| eval location=case(host LIKE "%MMK%","MMK", host LIKE "%RTP%", "RTP", 1==1, "Other")
| stats count by location

I used the case function, but there are other ways to do this as well.

You might also consider a lookup table, which could provide more information about your hosts:

host_list.csv
host,location,dept,ip
mmk01,"San Francisco",Finance,10.12.14.122
rtp03,Durham,Finance,10.72.24.214
etc.

Here is a tutorial on lookup tables.

[Murali2888]

you can use eval and searchmatch
| eval location= if(searchmatch("MMK"),"LiteralString1",if(searchmatch("RTP"),"LiteralString2","DEFAULTStr"))

[renjith_nair]

Try this

Your search |eval location=case(host LIKE "%MMK%", "MMKLOCATION", host LIKE "%RTP%", "RTPLOCATION", host LIKE "%", "Others")

[a212830]

Thanks! !!!

[renjith_nair]

No problem. Please mark as answer if it's resolved so that thread will be closed!

[renjith_nair]

@a212830 , if the answer helps you, please mark as answer. Thanks