topic Re: How to find square bracket in eval in Dashboards & Visualizations

How to find square bracket in eval

tamalunp — Wed, 14 May 2025 00:34:02 GMT

I need to find whether the string

["foobar"]

exists in a log message. I have a search query like

some stuff | eval hasFoobar = case(_raw LIKE "%\"foobar%", "Y") | eval hasFoobar = if(hasFoobar = "Y", "YES", "NO") | table message, hasFoobar

which gives YESes as expected.

If I add a square bracket, whether escaped or not, I only get NOes. E.g.,

some stuff | eval hasFoobar = case(_raw LIKE "%[\"foobar%", "Y") | eval hasFoobar = if(hasFoobar = "Y", "YES", "NO") | table message, hasFoobar

some stuff | eval hasFoobar = case(_raw LIKE "%\[\"foobar%", "Y") | eval hasFoobar = if(hasFoobar = "Y", "YES", "NO") | table message, hasFoobar

Any advice?

bowesmana — Wed, 14 May 2025 04:11:08 GMT

So this example shows that the LIKE works with the [

so there may be something odd with your data. Your example shows table message, not _raw. Can you provide an example of _raw

isoutamo — Wed, 14 May 2025 04:26:05 GMT

The easiest way to see _raw is open event and select from “event actions” sho source.

isoutamo_0-1747196649710.png
then you see if there is e.g. some escape characters like \u0022 => “

livehybrid — Wed, 14 May 2025 06:38:46 GMT

You could try with searchmatch maybe?

| eval isFoo=if(searchmatch("[\"foo\"]"),"yes","no")

livehybrid_0-1747204704335.png

Full example:

🌟 Did this answer help you? If so, please consider:

Your feedback encourages the volunteers in this community to continue contributing

tamalunp — Thu, 15 May 2025 13:58:26 GMT

This seemed like the solution at first, but there's a little quirk.

foo | eval hasFoo = if (searchmatch("\"foo\"]"), "YES", "NO") | table _raw hasFoo

In the case where _raw is like

... ["foo", "bar"] ...

hasFoo evaluates to "YES".

tamalunp — Thu, 15 May 2025 20:31:30 GMT

_raw is like

... \"products\": [\"foo\", \"bar\"], ...