Splunk Search

conditional field choice

wsw70
Communicator

Hello,

I have log files which have both IP numbers (field IP) and corresponding names (field DNSNAME).
I would like to chart (a distribution for instance) based on the names but unfortunately some of them are not available (the value of the field DNSNAME="N/A"). In that case I need to fallback to the IP.

If I always had names I would do

... | stats count by DNSNAME

Is there a way to construct something along the lines of

... | stats count [ if DNSNAME != "N/A" then "by DNSNAME" else "by IP" ) ]

I was looking around the eval & co. functions but the "if" mentioned there seems to work on a given field only (while I want to modify the search itself based on conditions)

Thanks!

Tags (1)
1 Solution

imrago
Contributor

... | eval newfield=if(DNSNAME=="N/A",IP,DNSNAME) | stats count by newfield

View solution in original post

imrago
Contributor

... | eval newfield=if(DNSNAME=="N/A",IP,DNSNAME) | stats count by newfield

wsw70
Communicator

Aahhh - I was looking at the "if" (as I mentioned) but somehow it did not ring a bell.
Thanks!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...