HI All,
I am trying to get results from a transaction request from users coming into the out systems.
There are various authentication steps that take place and I would like to capture those steps. There are 5 steps in a successful transaction, however, sometimes users come into the system multiple times, due to some type of issue.
I have managed to rename each step, however, if the eventcount is greater than 5, I would like to rename it "Multiple entries" or something similar. However, I cannot work out how do it. Is this possible in Splunk? Otherwise, I end up with a table/graph with fields 6, 8,12 etc.
index=int_sgw sourcetype=int_sgw_log | transaction SUB_ID maxspan=3m | chart count over host by eventcount | rename 1 AS "Radius ACCESS fail", 2 AS "Radius START fail", 3 AS "Login fail", 4 AS "Continue fail", 5 AS "Successful"
Thanks in advance.
Integers cannot be renamed, but perhaps this method will do.
... | chart count over host by eventcount | eval result=case(1, "Radius ACCESS fail", 2, "Radius START fail", 3, "Login fail", 4, "Continue fail", 5, "Successful",1=1,"") | ...
Integers cannot be renamed, but perhaps this method will do.
... | chart count over host by eventcount | eval result=case(1, "Radius ACCESS fail", 2, "Radius START fail", 3, "Login fail", 4, "Continue fail", 5, "Successful",1=1,"") | ...
Hi Rich,
Your answer put me on the right track. Below is how I got it to work.
Thanks for your prompt response 🙂
index=int_sgw sourcetype=int_sgw_log | transaction SUB_ID maxspan=3m | eval eventcount=case(eventcount=="1","Radius ACCESS fail", eventcount=="2","Radius START fail", eventcount=="3","Login fail", eventcount=="4","Continue fail", eventcount=="5","Successful")| chart count over host by eventcount | rename NULL as Multiple_connections
Try this:
index=int_sgw sourcetype=int_sgw_log | transaction SUB_ID maxspan=3m | chart count AS C over host by eventcount | eval C=if(match(C,"1"),"Radius ACCESS fail",if(match(C,"2"),"Radius START fail"),if(match(C,"3"),"Login fail",if(match(C,"4"),"Continue fail",if(match(C,"5"),"Successful","Multiple Entries")))))
Thanks for your response jkat54