Splunk Search

how i can convert my field value

kml_uvce
Builder

I am getting this in output of the search
index=* host="216.167.15.70"
and getting dest_port field value as "ssh" , I want to convert this field value to 22,please help me on this...

Tags (2)
0 Karma
1 Solution

kml_uvce
Builder

use replace like

..|replace ssh with "22" in dest_port

View solution in original post

0 Karma

kml_uvce
Builder

use replace like

..|replace ssh with "22" in dest_port

0 Karma

kml_uvce
Builder

my csv file is
dest_port,value
ssh,22

and I am writing this csv file in search head

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...