topic Re: Case with multiple matches in Splunk Search

Case with multiple matches

maniishpawar — Tue, 29 Sep 2020 16:31:16 GMT

Hello all,

I am trying this search but it's not working.
Only the first match count is returned.

index=abc* sourcetype=applogfile
| eval _rawtext=_raw
| eval P_ErrMsg=case(_rawtext LIKE "%conflict%", "FKEY1", _rawtext like "%FOREIGN KEY%", "FKEY",_rawtext like "%nonexistingvalue%","garbagevalue")
| stats count by P_ErrMsg

Re: Case with multiple matches

DalJeanis — Mon, 30 Oct 2017 19:51:48 GMT

1) Case, in pretty much all languages, is equivalent to a nested if-then structure. You don't get multiple answers.

2) There is no reason to copy the data from _raw to _rawtext.

3) A simple rex will pull what you need, then you can change the values after the stats command.

index=abc* sourcetype=applogfile
| rex "(?<P_ErrMsg>conflict|FOREIGN KEY|nonexistingvalue)" max_match=0
| eval P_ErrMsg=mvdedup(P_ErrMsg)
| stats count by P_ErrMsg
| eval P_ErrMsg=case(P_ErrMsg=="conflict", "FKEY1",  
    P_ErrMsg=="FOREIGN KEY", "FKEY",
    P_ErrMsg=="nonexistingvalue","garbagevalue")

Re: Case with multiple matches

niketn — Mon, 30 Oct 2017 20:12:59 GMT

@maniishpawar, can you please add some sample data where Only the first match count is returned?

| makeresults 
| eval _raw="some conflict while finding FOREIGN_KEY" 
| append 
    [| makeresults 
    | eval _raw="Event with nonexistingvalue"] 
| eval P_ErrMsg=case(searchmatch("conflict"), "FKEY1"
    ,searchmatch("FOREIGN KEY"), "FKEY"
    ,searchmatch("nonexistingvalue"),"garbagevalue") 
| stats count by P_ErrMsg

As @DalJeanis has mentioned you should avoid a command like | eval _rawtext=_raw to copy raw data over from one field to another. Alternative to Dal's approach, you can also try searchmatch() function which matches your criteria against the _raw data. Splunk Documentation for reference: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions#searchmatch.28X.29
PS: Pipes with | makeresults and | append are used to generate some mock data. You would need to replace with your base search. Also it is better id you added your own mocked up sample events (with sensitive information masked or anonymized)

| makeresults 
| eval _raw="some conflict while finding FOREIGN_KEY" 
| append 
    [| makeresults 
    | eval _raw="Event with nonexistingvalue"]