User defined inputs for a field in splunk

[Chandras11]

Hi,

I have a situation, where user/admin need to verify if the event should be taken into consideration or not.
In excel, I have a field where user/admin can put YES or NO values. By default, all values are YES but if user disagrees, the field value can be changed to NO.

Is it possible in Splunk to eval or create a field with boolean YES/NO, which can be changed by user/admin? Or if there is any other way to do this.

Thanks a lot for your time and help.

[niketn]

@chandras11, ideally you should look into setting up Workflow Actions if your decision is based on Events.
An option for you to perform such kind of operation within Splunk would be to setup a KV Store where a form can be setup for Users/Admins to update the value while everyone can read the value through lookup commands similar to CSV.

PS: This can also be done via csv Lookup File. However, for details on the same can be provided based on further details as to what kind of events you are looking at and under what circumstance should the value be changed? How is this Yes/No mapped to events and what does it indicate?

[Chandras11]

Thanks a lot for this info.
I have the whole incident tickets index (1000+ on a monthly basis). And I want to check which of the rejected tickets (100+ on monthly basis) cab be invoiced or not. The User/Admin need to go through the various fields (already included in the event) and then decide if the tickets should be invoiced or not.
Therefore the question was to add a user-defined input field for all selected events and then use this field for further calculations.

[PowerPacked]

Hi @Chandras11

add csv file to splunk through - settings - lookups - lookup tables

Use lookup command to add the field with YES/NO to every event,

ex: your search | lookup 123.csv host as hostname output fieldyesno

finally filter out the events just with doing -- fieldyesno=YES/NO as per your wish

Please go through this lookup documentation, willl be helpfull

http://docs.splunk.com/Documentation/Splunk/7.1.0/SearchReference/Lookup

Thanks