Set field records & IF Statements

[Kdeep]

When I search my results I want it to update the field accordingly.

For example in my case when i search my Audit logs , The log contains the words "write control" and "Read control" within the text of the log but the field is set to Read Control instead of Write.

So if the log contains the word Write i want it to replace the field Accesses to Write instead of Read.

This is the search I am using

EventCode="5145" NOT Relative_Target_Name="Desktop.ini" NOT Share_Name="\*\IPC$" NOT Relative_Target_Name="\" | table Account_Name,Accesses, Share_Name,Relative_Target_Name,Da_te,Ti_me,AM_PM

Any help with this will be great...

[kristian_kolb]

..or do you mean that you want to create a new field (within the search) based on some text in the event?

... | eval Accesses = if(match(_raw, "Write Control"), "Write", "Read")

The eval will create the field Accesses (or change it if it already exists). If the string "Write Control" exists within the event (_raw is the whole event), Accesses will be set to "Write", otherwise it will be set to "Read".

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/CommonEvalFunctions

/K

[kristian_kolb]

It is not really clear what you want to achieve. Do you have problems with the field extraction?

Or do you want to rename the field, based on its value?

Please post a few sample events.

/K