Splunk Search

How to find certain field values and change the value into another field

ajdyer2000
Path Finder

If the vulnerability column has a certain value then a new column called ‘Software_Affected’ has a corresponding value like below--

  1. DES” is in the vulnerability column then the new ‘Software Affected’ column value is “3DES”
  2. 7-Zip” is in the vulnerability column then the new ‘Software Affected’ column value is “7-Zip”
  3. Acrobat”is in the vulnerability column then the new ‘Software Affected’ column value is “Adobe Acrobat”
  4. Flash” is in the vulnerability column then the new ‘Software Affected column value is “Adobe Flash”

Thanks for your help. This is the best forum !!!
Alan

0 Karma

solarboyz1
Builder
| eval "Software Affected"=case(match(vulnerability,"*Flash*"),"Adobe Flash", match(vulnerability,"*Acrobat*"),"Adobe Acrobat",match(vulnerability,"*7-Zip*"),"7-Zip",match(vulnerability,"*DES*"),"3DES","Unknown")

If you have a large number so that using case isnt efficient, then using a lookup as @diogofgm recommends:

| lookup yourlist vulnerability OUTPUT Software_Affected 
0 Karma

Sukisen1981
Champion

from where do you get 3DES in the first sample and how do you add adobe to the last?

0 Karma

diogofgm
SplunkTrust
SplunkTrust

You can use a lookup configured to use wildcards

create your lookup like this
"vulnerability","software_affected"
Flash”,“Adobe Flash”
etc

and then follow the steps in this answer
https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...