Splunk Search

Replace string to replace entire Message field with another message for specific EventCode??

priya0709
Path Finder

My query searches for (Eventcode=509 OR EventCode=118) and generates output (host, Time, EventCode, Task category, Mesaage)

Is it possible to use REPLACE to replace entire message field with another message associated with the EventCode??

 

Labels (1)
0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Use some conditional logic combined with an eval to get it done 

 

| eval Message=if(Eventcode=509 OR EventCode=118,"Insert new message here",Message)

View solution in original post

0 Karma

priya0709
Path Finder

My query searches for eventcode and displays (host, time, task category, message) i want to use some color to highlight all  same hosts generating multiple eventcode??

please help with the query

 

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Use some conditional logic combined with an eval to get it done 

 

| eval Message=if(Eventcode=509 OR EventCode=118,"Insert new message here",Message)

0 Karma

priya0709
Path Finder

thank you!!! This worked😊😊

skoelpin
SplunkTrust
SplunkTrust

If my solution worked, can you accept it rather than your own? 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...