Splunk Enterprise

How do I make a string into a field / variable?

hollybross1219
Path Finder

Hello, my raw logs look something like this: 

Example 1:

2021-02-03 23:59:07,216 LogLevel=INFO my_appid= intuit_tid=EFEtoPBI805aaa9f-9254-499b-ae80-    2c39ca7b33cd provider_tid=fe62e521-a9c6-4d3a-8c45-a25a10abd5ac     class=com.intuit.fds.provider.dao.impl.EinDAOImpl Get disabled ein by ein=821570477

Example 2:

2021-02-03 23:59:07,216 LogLevel=INFO my_appid= intuit_tid=EFEtoPBI805aaa9f-9254-499b-ae80-2c39ca7b33cd provider_tid=fe62e521-a9c6-4d3a-8c45-a25a10abd5ac class=com.intuit.fds.provider.service.impl.EinServiceImpl Create or update ein=821570477 einVO=EinVO [ein=821570477, active=false, einProviderRelationships=EinProviderRelationshipsVO [einProviderRelationship=[EinProviderRelationshipVO [id=null, active=null, providerId=5ece3c4d-6791-4bed-bbf5-fd9c0736c129, taxYear=2020, serviceName=W2, actualAvailabilityDate=2021-02-03T23:59:07.172-08:00, expectedAvailabilityDate=2021-02-03T23:59:07.172-08:00, preference=1, synced=false]]]]

My goal is to create a single field / variable (let's call it action_type) where the value of that field is determined by the presence of the string "Create or update" (action_type=add) or "Get disabled" (action_type=disable). 

My struggle is that these strings aren't associated with any fields, so I'm not sure how to have my eval include the LIKE function without defining a field. Please help!

My work:

[base query]

|eval action_type=CASE( LIKE(??, "Get disabled"), "disable", LIKE(??, "Create or update"), "add", 1==1, "null")

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @hollybross1219,

You can use _raw field with match;

| eval action_type=CASE( match(_raw, "Get disabled"), "disable", match(_raw, "Create or update"), "add", 1==1, "null")
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

hollybross1219
Path Finder

Thank you @scelikok !!

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @hollybross1219,

You can use _raw field with match;

| eval action_type=CASE( match(_raw, "Get disabled"), "disable", match(_raw, "Create or update"), "add", 1==1, "null")
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...