I'm new to Splunk and my problem is:
I have a field called Environment which is composed of 7 elements (Backup, Production Pre-Production, Recipe, Qualification, Development, Integration).
And I wanted to group my accounts into 2 groups Production (Production, Pre-Prod, Backup) and off Prod (Recipe, development, qualification, integration
Thanks
You can pipe the following eval:
<Your Base Search>
| eval EnvironmentGroups=case(Environment="Backup" OR Environment="Pre-Prod" OR Environment="Production","Production", true(), "off Prod")
PS: You can also create a Calculated Field for the above if it applies for All events and all searches that you run.
Try updating the same field or creating a new field -
| eval Environment=case(Environment=="Backup", "Production", Environment=="Pre-Prod", "Production", Environment=="Production","Production",Environment=="Recipe", "Off Prod", Environment=="Development", "Off Prod", Environment=="Qualification","Off Prod", Environment=="Integration","Off Prod")
OR
| eval ENV=case(Environment=="Backup", "Production", Environment=="Pre-Prod", "Production", Environment=="Production","Production",Environment=="Recipe", "Off Prod", Environment=="Development", "Off Prod", Environment=="Qualification","Off Prod", Environment=="Integration","Off Prod")
Note: Field names are case sensitive.
You can pipe the following eval:
<Your Base Search>
| eval EnvironmentGroups=case(Environment="Backup" OR Environment="Pre-Prod" OR Environment="Production","Production", true(), "off Prod")
PS: You can also create a Calculated Field for the above if it applies for All events and all searches that you run.