Splunk Search

If - Then Logic in Table Results With Column Value Based on Field Results in Search

SplunkLunk
Path Finder

Good morning,

I have a search that looks through and Oracle database for an ACTION_NAME:

source="dbx:[DB source]" sourcetype="oracle:audit:trail" USERNAME!=SYS AND ACTION_NAME=LOGON

Those events also include a RETURNCODE which defines if it was a successful logon. For example if the ACTION_CODE=LOGON and RETURNCODE=0, then it was a successful login. If ACTION_CODE=LOGON and RETURNCODE!=0, then it was a failed logon. How can I build a table that displays the RETUNRCODE as a text value of "Failed" or "Successful" based on the RETURNCODE value of 0 or <>0?

Any help would be appreciated. Thanks.

Tags (1)
0 Karma
1 Solution

rjthibod
Champion

You can add the following to your query

| eval LogonStatus = if (RETURNCODE==0, "Successful", "Failed")

After that you will have a new field LogonStatus that you can use in your table as you see fit.

View solution in original post

0 Karma

rjthibod
Champion

You can add the following to your query

| eval LogonStatus = if (RETURNCODE==0, "Successful", "Failed")

After that you will have a new field LogonStatus that you can use in your table as you see fit.

0 Karma

SplunkLunk
Path Finder

Thank you! That is exactly what I am looking for! Much Appreciated.

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...