Hi there,
I have a log that prefaces each message with either "Sending data on connection" or "Received data on connection". I have created an extraction to extract this value as "Direction", but I'd like to be able to show that result in a table as simply "Inbound" or "Outbound". Can anyone point me in the right direction for this?
Thanks in advance,
Brandon
You could use eval
. Let's say you extracted the values "Sending" and "Received", respectively:
... | eval dir_type=case(Direction,"Sending","Outbound","Received","Inbound")
Yes, you could use a lookup table for that. Also, in Splunk 5.0 that is due out...sometime in the future, you can setup eval statements in configuration files!
Thanks, Ayn. That worked, but seems very cumbersome in the search. Would a lookup table be able to accomplish this and keep the usability? For instance, enabling a user to use a search including direction=inbound ?