Splunk Search

Two fields (same value), fill in third field

rocarril
Engager

My dataset has three fields from two different data sources. Two fields are identical (hostnames with different field names). One dataset has a third field that I would like to fill in. Example:

sourcetype . hostname1 computer1 . domain
source1 . host1 . NT1
source1 . host2 NT2
source2 host1
source2 host2

Want to it to be:

sourcetype . hostname1 computer1 . domain
source1 . host1 . host1 NT1
source1 . host2 host2 NT2
source2 host1 host1 NT1
source2 host2 host2 . NT2

Tags (1)
0 Karma

Kwip
Contributor

| eval Domain=case(
hostname1="host1" AND computername1="host1", "NT1",
hostname1="host2" AND computername1="host2", "NT2")

Same can achieve via lookup if you have large no of values to be created.

0 Karma

micahkemp
Champion

How are the values NT1 and NT2 determined for the last two events in your example output?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...