https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-include-two-like-eval-expressions-in-splunk/m-p/411889#M4861 <P>The first <CODE>eval</CODE> loses the the original text in 'message'. Later <CODE>eval</CODE>s need to refer to 'message' as well. Try this:</P> <PRE><CODE>| eval logins=if(like(message,"Login%"),"is_login","is_not_login") | eval action=case(like(message,"Login failed%") AND logins=="is_login", "Failure", NOT like(message,"Login failed%") AND logins=="is_login", "Success", 1=1, "") </CODE></PRE> Fri, 18 May 2018 04:11:23 GMT richgalloway 2018-05-18T04:11:23Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-include-two-like-eval-expressions-in-splunk/m-p/411887#M4859 <P>I am working on eval expression. I have a set of data and I want to evaluate a field such that I only extract login authentication messages. <BR /> The following search string helps to extract only logins:<BR /> <STRONG>| eval logins=if(like(message,"Login%"),"is_login","is_not_login")</STRONG><BR /> is_login :84 events (failed and successful login events)<BR /> is_not_login: 551 events (all other events)<BR /> I would like to create a second eval expression where I zoom in on "is_login" field and further split the values into two.<BR /> <STRONG>|eval action=if(like(is_login,"Login failed%"),"Failure","Success")</STRONG><BR /> No Failure value in 'action' field.<BR /> Success: 635 events (whole log file events)<BR /> I expect to get a field 'action' with two values within it, Failure and Success. However I only get one Success value which represents all events from the log file itself. </P> <P>Combined eval search:<BR /> <STRONG>| eval logins=if(like(message,"Login%"),"is_login","is_not_login") |eval action=if(like(is_login,"Login failed%"),"Failure","Success")</STRONG></P> <P>I need help to see if my logic is correct, the first eval seperates login events from all other events, the second eval further divides the failed and successful login events. </P> Tue, 29 Sep 2020 19:38:42 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-include-two-like-eval-expressions-in-splunk/m-p/411887#M4859 gilbxrtx_7 2020-09-29T19:38:42Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-include-two-like-eval-expressions-in-splunk/m-p/411888#M4860 <P>Logins has two values is_login and is_not_login. So in second event you cant perform eval on values, "like" function work on fields not on values.</P> Tue, 29 Sep 2020 19:34:42 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-include-two-like-eval-expressions-in-splunk/m-p/411888#M4860 p_gurav 2020-09-29T19:34:42Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-include-two-like-eval-expressions-in-splunk/m-p/411889#M4861 <P>The first <CODE>eval</CODE> loses the the original text in 'message'. Later <CODE>eval</CODE>s need to refer to 'message' as well. Try this:</P> <PRE><CODE>| eval logins=if(like(message,"Login%"),"is_login","is_not_login") | eval action=case(like(message,"Login failed%") AND logins=="is_login", "Failure", NOT like(message,"Login failed%") AND logins=="is_login", "Success", 1=1, "") </CODE></PRE> Fri, 18 May 2018 04:11:23 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-include-two-like-eval-expressions-in-splunk/m-p/411889#M4861 richgalloway 2018-05-18T04:11:23Z