When I search my results I want it to update the field accordingly.
For example in my case when i search my Audit logs , The log contains the words "write control" and "Read control" within the text of the log but the field is set to Read Control instead of Write.
So if the log contains the word Write i want it to replace the field Accesses to Write instead of Read.
This is the search I am using
EventCode="5145" NOT RelativeTargetName="Desktop.ini" NOT ShareName="\*\IPC$" NOT RelativeTargetName="\" | table AccountName,Accesses, ShareName,RelativeTargetName,Date,Time,AMPM
Any help with this will be great...
It is not really clear what you want to achieve. Do you have problems with the field extraction?
Or do you want to rename the field, based on its value?
Please post a few sample events.
..or do you mean that you want to create a new field (within the search) based on some text in the event?
... | eval Accesses = if(match(_raw, "Write Control"), "Write", "Read")
The eval will create the field Accesses (or change it if it already exists). If the string "Write Control" exists within the event (_raw is the whole event), Accesses will be set to "Write", otherwise it will be set to "Read".