Splunk Search

Replace string to replace entire Message field with another message for specific EventCode??

priya0709
Path Finder

My query searches for (Eventcode=509 OR EventCode=118) and generates output (host, Time, EventCode, Task category, Mesaage)

Is it possible to use REPLACE to replace entire message field with another message associated with the EventCode??

 

Labels (1)
0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Use some conditional logic combined with an eval to get it done 

 

| eval Message=if(Eventcode=509 OR EventCode=118,"Insert new message here",Message)

View solution in original post

0 Karma

priya0709
Path Finder

My query searches for eventcode and displays (host, time, task category, message) i want to use some color to highlight all  same hosts generating multiple eventcode??

please help with the query

 

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Use some conditional logic combined with an eval to get it done 

 

| eval Message=if(Eventcode=509 OR EventCode=118,"Insert new message here",Message)

0 Karma

priya0709
Path Finder

thank you!!! This worked😊😊

skoelpin
SplunkTrust
SplunkTrust

If my solution worked, can you accept it rather than your own? 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...