Knowledge Management

Splunk Calculated fields

namritha
Path Finder

Hi,

I may be looking in the wrong place, but I am not able to find out information on how to use a few calculated fields.

I have a requirement like this,

If host = "host 1 or host 2 or host 3 . . . . . host10" -> mark clusterName as ClusterA
If host = "host 11 or host 12 or host 13 . . . . . host20" -> mark clusterName as ClusterB

I have attached the screenshot of the page to create calculated fields.

alt text

Is the below info correct?
Destination app - My custom app
Apply to - Host
named ---- WHAT SHOULD I GIVE???
Name-clusterName
Eval expression - host 1 or host 2 or host 3 . . . . . host10

Kindly help me out.

0 Karma

ddrillic
Ultra Champion

The Apply to selection gives the context/scope of the new field.

Name can be ClusterName.

The Eval expression can be -

case(

 host == "host1", "ClusterA", 
 host == "host2", "ClusterA",
 host == "host3", "ClusterA",

.... to add the rest 

 host == "host11", "ClusterB", 
 host == "host12", "ClusterB",
 host == "host13", "ClusterB",

.... to add the rest 
)

By doing that you end up with a new field called ClusterName which would have either ClusterA or ClusterB as its value.

0 Karma

lukejadamec
Super Champion

Here is a corrected answer....
In this case where you want to evaluate all hosts, then named would be *
Apply to = Host
Named = *
Name = your name for the resultant group
Eval expression = the expression that isolates the group

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...