Splunk Search

relating fields with eval

jrich523
Path Finder

I have two fields (different sourcetypes) that have a Node ( for example: node001) and NodeID (example: 1)

How would i extract Node to NodeID dealing with the leading zeros?

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

First you'll need to search for events from both sourcetypes, then normalize your Node field to match the NodeID field, and then do whatever you're actually trying to do with the data:

  sourcetype=eventsWithNodeID OR sourcetype=eventsWithNode
| rex field=Node "0*(?<tempNodeID>\d+)$" | eval mergedNodeID = case(sourcetype="eventsWithNodeID", NodeID, sourcetype="eventsWithNode", tempNodeID)
| stats values(foo) as foo max(bar) as bar by mergedNodeID

Check out the excellent March 2016 Virtual.conf talk by @sideview on this very subject available at http://wiki.splunk.com/Virtual_.conf

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

First you'll need to search for events from both sourcetypes, then normalize your Node field to match the NodeID field, and then do whatever you're actually trying to do with the data:

  sourcetype=eventsWithNodeID OR sourcetype=eventsWithNode
| rex field=Node "0*(?<tempNodeID>\d+)$" | eval mergedNodeID = case(sourcetype="eventsWithNodeID", NodeID, sourcetype="eventsWithNode", tempNodeID)
| stats values(foo) as foo max(bar) as bar by mergedNodeID

Check out the excellent March 2016 Virtual.conf talk by @sideview on this very subject available at http://wiki.splunk.com/Virtual_.conf

changux
Builder

Hi. Something like:

sourcetype=X OR sourcetype=Y | rename Node* as *

Can be an option.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...