Getting Data In

Can I do an if else in a props.conf?

pfabrizi
Path Finder

I am using Graylog to forward my windows events, all the events field names start with winlogbeat, but some are
_event_data_targetname and some are _event_data_Subjectname. This appears to be different based on windows event type.

Can I do a

if winlogbeats_event_data_targetnamedomain  not null then 
                FIELDALIAS-winlogbeat_as_account_domain = winlogbeat_event_data_TargetDomainName as Account_Domain
else
               FIELDALIAS-winlogbeat_as_account_domain = winlogbeat_event_data_SubjectDomainName as Account_Domain

Thanks!

0 Karma
1 Solution

pradeepkumarg
Influencer

You can do something like below

FIELDALIAS-winlogbeat_as_account_domain_target = winlogbeat_event_data_TargetDomainName as Account_Domain
FIELDALIAS-winlogbeat_as_account_domain_subject = winlogbeat_event_data_SubjectDomainName as Account_Domain
EVAL-winlogbeat_as_account_domain= coalesce(winlogbeat_as_account_domain_target , winlogbeat_as_account_domain_subject )

Calculated fields

https://docs.splunk.com/Documentation/Splunk/7.1.1/Knowledge/definecalcfields

View solution in original post

0 Karma

pradeepkumarg
Influencer

You can do something like below

FIELDALIAS-winlogbeat_as_account_domain_target = winlogbeat_event_data_TargetDomainName as Account_Domain
FIELDALIAS-winlogbeat_as_account_domain_subject = winlogbeat_event_data_SubjectDomainName as Account_Domain
EVAL-winlogbeat_as_account_domain= coalesce(winlogbeat_as_account_domain_target , winlogbeat_as_account_domain_subject )

Calculated fields

https://docs.splunk.com/Documentation/Splunk/7.1.1/Knowledge/definecalcfields

0 Karma

pfabrizi
Path Finder

Thank You!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...