Splunk Search

[Help] Creating a new Field for matching Value

Zyon
Engager

Hi,

Currently, my Splunk search is:

sourcetype="Blacklist" OR sourcetype="log" | eval blacklisted=if(sourcetype=="Blacklist",_raw,null()) | fields - _raw | fields blacklisted,SRC 

I am able to see two fields, blacklisted and SRC.

May i ask if it is possible to do the following:

  • Create a new field to store values that matches between the 2 fields.

Thanks a lot!

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If by "matches between the 2 fields" you mean if they equal each other, you can do this:

sourcetype="Blacklist" OR sourcetype="log" | eval blacklisted=if(sourcetype=="Blacklist",_raw,null()) | fields - _raw | fields blacklisted,SRC | eval matches = if(blacklisted==SRC, "match", "no match")

If you're thinking of something else then please elaborate.

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee
0 Karma

Zyon
Engager

Thanks a lot!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

If by "matches between the 2 fields" you mean if they equal each other, you can do this:

sourcetype="Blacklist" OR sourcetype="log" | eval blacklisted=if(sourcetype=="Blacklist",_raw,null()) | fields - _raw | fields blacklisted,SRC | eval matches = if(blacklisted==SRC, "match", "no match")

If you're thinking of something else then please elaborate.

0 Karma

Zyon
Engager

Yes, this is what i'm thinking of. Thanks a lot!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...