topic How to check for underscore in field values? in Splunk Cloud Platform

How to check for underscore in field values?

Splunkerninja — Mon, 20 Nov 2023 07:44:27 GMT

Hi,

I am checking for underscore in field values and if it present then capture that value.

For Example: if name has underscore in it then value should get assigned to APP field and if it does not have underscore in it then value should get assigned to Host field

name APP Host

ftr_score ftr-score NA

terabyte NA terabyte

I have tried using case and like statement but it does not work as expected

Re: How to check for underscore in field values?

bharathkumarnec — Mon, 20 Nov 2023 08:04:43 GMT

@Splunkerninja there are many way to achieve this, for example like below:

Re: How to check for underscore in field values?

ITWhisperer — Mon, 20 Nov 2023 08:33:58 GMT

Your example seems to change the underscore to a hyphen (I have assumed that this is a typo). Also, your criteria is not very precise, so I have assumed that you mean not an underscore, followed by an underscore, followed by not an underscore somewhere in the name.

| eval APP=if(match(name,"[^_]_[^_]"),name,null()) | eval Host=if(match(name,"[^_]_[^_]"),null(),name)

You may need to adjust the match expression if the criteria I have used is not what you meant.