custom text to the results

[selvam_sekar]

Hi,

from the logs, i have extracted the below data(table1). I would like to add another column as in Table2 with custom keyword if filename begins xyz then "Core".

Please could you suggest what splunk query or logic we could apply?

Splunk Query:

base search | rex field User | rex field Folder | rex filed File
| table User  Folder File

Table1: 

User	Folder	File
ABC	first	xyz07122023

Table 2: Required Output

User	Folder	File	Consumer
ABC	first	xyz07122023	Core

[richgalloway · Accepted solution]

Use the eval command to add a field ("column").  The match function will compare a field to a string/regular expression.

base search 
| rex field User | rex field Folder | rex field File
| eval Consumer = if(match(File, "^xyz"), "Core", "")
| table User Folder File Consumer

[selvam_sekar]

Thanks, it worked as expected.

If we have 3 or multiple matches, do we required to write individual eval as mentioned below?

for example,

File	Consumer
XYZ_*	Core
ABC_*	Core
MNP_*	Non-Core
RST	Non-Core

SPL: 

base search 
| rex field User | rex field Folder | rex field File
| eval Consumer = if(match(File, "^xyz"), "Core", "")
| eval Consumer = if(match(File,"^ABC"),"Core","")
| eval Consumer = if(match(File,"^MNP"),"Non-Core","")
| table File Consumer

[richgalloway]

That won't work as expected.  If File is "XYZ_*" then Consumer will be set to "" because of the last eval statement.  For instances like this, use the case function.

base search 
| rex field User | rex field Folder | rex field File
| eval Consumer = case(match(File, "^xyz"), "Core",
                       match(File,"^ABC"),"Core",
                       match(File,"^MNP"),"Non-Core",
                       1==1,"Others")
| table File Consumer

[selvam_sekar]

Thanks a lot

[selvam_sekar]

Excellent! Many thanks.

is it possible if we make the non-matching of  the below files to map "Others".

for example,

other than file name starts with xyz, ABC, MNP  as Others.

[richgalloway]

See my updated reply.  The last clause of this case function handles non-matches.