Splunk Search

Set field records & IF Statements

Kdeep
New Member

When I search my results I want it to update the field accordingly.

For example in my case when i search my Audit logs , The log contains the words "write control" and "Read control" within the text of the log but the field is set to Read Control instead of Write.

So if the log contains the word Write i want it to replace the field Accesses to Write instead of Read.

This is the search I am using

EventCode="5145" NOT Relative_Target_Name="Desktop.ini" NOT Share_Name="\*\IPC$" NOT Relative_Target_Name="\" | table Account_Name,Accesses, Share_Name,Relative_Target_Name,Da_te,Ti_me,AM_PM

Any help with this will be great...

Tags (3)
0 Karma

kristian_kolb
Ultra Champion

..or do you mean that you want to create a new field (within the search) based on some text in the event?

... | eval Accesses = if(match(_raw, "Write Control"), "Write", "Read")

The eval will create the field Accesses (or change it if it already exists). If the string "Write Control" exists within the event (_raw is the whole event), Accesses will be set to "Write", otherwise it will be set to "Read".

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/CommonEvalFunctions

/K

kristian_kolb
Ultra Champion

It is not really clear what you want to achieve. Do you have problems with the field extraction?

Or do you want to rename the field, based on its value?

Please post a few sample events.

/K

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...