I need help in defining 3 new fields using Splunk User interface.
Any help is greatly appreciated.
As @Sukisen1981 says, example data is needed. Without it, almost any answer will be a shot in the dark. You can obfuscate the data, but don't change the nature of it so that it is useful in helping you.
Thank you so much. Below are my requirements:
I want to define a field using the UI in Field Transformations in Field settings:
The field need to match a string value ex: "Agreed". I want the field name to be defined as "Decision".
When I search in the search box, I want the field "Decision" to appear in the list of fields.
Thank you for your time.
You may want a transform. You may want a field extraction. They are similar. If the fields you want are related to a sourcetype, or to a source, then do a field extraction. If you want it to happen on any data, then do a transform.
But, I can't help you without an example data to look at. Just to look for a string and then make a field could be useful, and may not be. I assume from your description that you could have something other than
Agreed as a value for
Decision, otherwise you would never care about doing a field extraction. What you ask for without an example is equivalent to marking everything blue that you see as your favorite car.
1- Not clear, assuming you have a field, say X which has 'agree' and other values, if so try
2- eval Time=strftime(_time,"%d %H:%M:%S"). Are you missing year and/ or month components?
3- Witthout looking at your data its is hard to say but have you looked at this? ip extraction is very common question answered many times befre