Splunk Enterprise

Extract field as status from different text strings

jlimlogic
New Member

We are feeding SNMP trap data from a video transcoding device into Splunk.

When a video feed goes down, the following text shows up in the SNMP Trap data:

"Low bitrate in source 'abc'"

The above effectively means that the video stream has gone down and is therefore streaming at zero bitrate.

and when the video stream is restored, the following text is received via an SNMP trap:

"Cleared condition (Low bitrate in source 'abc'"

We'd like to extract a new field called low_bitrate and set the value of the field to true or false, depending on the text string received in the snmp trap as detailed above.

Tags (1)
0 Karma
1 Solution

sundareshr
Legend

You can use calculated field to create the new field. Try something like this (you will have to edit the regex to your specific data)

base search | eval low_bitrate=case(match(_raw, "\sLow bitrate"), "true", match(_raw, "Cleared condition \s\(Low bitrare"), "false", 1=1., null())

http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Configurecalculatedfieldswithprops.conf

View solution in original post

0 Karma

sundareshr
Legend

You can use calculated field to create the new field. Try something like this (you will have to edit the regex to your specific data)

base search | eval low_bitrate=case(match(_raw, "\sLow bitrate"), "true", match(_raw, "Cleared condition \s\(Low bitrare"), "false", 1=1., null())

http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Configurecalculatedfieldswithprops.conf

0 Karma

jlimlogic
New Member

Calculated field worked great - thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...