Hi,
I have a splunk query which reads a log file and returns a list of values to a chart. However I need to values to be more "readable".
e.g. output:
$#@VALUE_1 ===> ONE
$#@VALUE_2 ===> TWO
$#@VALUE_3 ===> THREE
is there a way to say "if the value is $_VALUE_1, then output "ONE", else if the value is $_VALUE_2 then output "TWO"?
I am not able to modify what is written to the actual log
You can use "eval"/"case" to create a new field with the desired value. This assumes those values are in the same existing field
... | eval new_field=case(old_field == "$_VALUE_1", "ONE", old_field == "$_VALUE_2", "TWO")
You can use "eval"/"case" to create a new field with the desired value. This assumes those values are in the same existing field
... | eval new_field=case(old_field == "$_VALUE_1", "ONE", old_field == "$_VALUE_2", "TWO")