Splunk Search
Highlighted

Set field records & IF Statements

New Member

When I search my results I want it to update the field accordingly.

For example in my case when i search my Audit logs , The log contains the words "write control" and "Read control" within the text of the log but the field is set to Read Control instead of Write.

So if the log contains the word Write i want it to replace the field Accesses to Write instead of Read.

This is the search I am using

EventCode="5145" NOT RelativeTargetName="Desktop.ini" NOT ShareName="\*\IPC$" NOT RelativeTargetName="\" | table AccountName,Accesses, ShareName,RelativeTargetName,Date,Time,AMPM

Any help with this will be great...

Tags (3)
0 Karma
Highlighted

Re: Set field records & IF Statements

Ultra Champion

It is not really clear what you want to achieve. Do you have problems with the field extraction?

Or do you want to rename the field, based on its value?

Please post a few sample events.

/K

0 Karma
Highlighted

Re: Set field records & IF Statements

Ultra Champion

..or do you mean that you want to create a new field (within the search) based on some text in the event?

... | eval Accesses = if(match(_raw, "Write Control"), "Write", "Read")

The eval will create the field Accesses (or change it if it already exists). If the string "Write Control" exists within the event (_raw is the whole event), Accesses will be set to "Write", otherwise it will be set to "Read".

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/CommonEvalFunctions

/K