topic Re: How to change a name within a field? in Splunk Search

How to change a name within a field?

happysplunkyay — Fri, 21 Apr 2017 17:49:20 GMT

I have hundreds of .tmp files that begin with evb* and exist within the "File Name" field. All I want to do is change all of their names to EVB. I've tried match, eval, rename, banging my head against the wall, and staring at my screen wishing it to happen. I'm sure it's something simple, but i'm missing it.

eval file=case("File Name"="evbd*","EVB")

Please help!

Re: How to change a name within a field?

somesoni2 — Fri, 21 Apr 2017 18:22:39 GMT

The eval command doesn't support the wildcards that you use in base search. Instead use comparison functions e.g. like or match, like this. Also, in right side of eval/where, the field name should be enclosed in single quotes. With double quotes they are treated as literal string, not field:
Updated

eval file=case(like('File Name',"evbd%"),"EVB",'File Name')

eval file=case(match('File Name',"evbd"),"EVB",'File Name')

Also added default value for file should be same as "File Name" if it doesn't match your condition.

Re: How to change a name within a field?

adonio — Fri, 21 Apr 2017 18:23:55 GMT

try single commas, answer here:
https://answers.splunk.com/answers/54359/eval-function-on-a-column-that-has-spaces.html

eval file=case('File Name'="evbd*","EVB")

Re: How to change a name within a field?

happysplunkyay — Fri, 21 Apr 2017 18:37:27 GMT

eval file=case(match('File Name',"evb*","EVB",'File Name')) |table file
gives me the error "Error in 'eval' command: The arguments to the 'match' function are invalid."

eval file=case(like('File Name',"evb*","EVB",'File Name')) |table file
just straight up says "The search job has failed due to an error."

I don't understand why it has to be this way - WHY OH WHY!?!?!?! 🙂

Thanks for your time, sir.

Re: How to change a name within a field?

happysplunkyay — Fri, 21 Apr 2017 18:39:01 GMT

the single quotes is definitely something I had wrong. As somesoni2 below stated, it's the wildcard * that eval doesn't get along with...

thanks for your time.

Re: How to change a name within a field?

somesoni2 — Fri, 21 Apr 2017 19:13:42 GMT

Silly me. Missed position of brackets. Try the updated answer now.

Re: How to change a name within a field?

happysplunkyay — Fri, 21 Apr 2017 19:24:35 GMT

I would LOVE to say that did it, but the changing of the parenthetical position didn't do the trick. It seems like this would be so easy. Thanks again for your time.

|eval file=case(match('File Name',"evb*"),"EVB",'File Name') |table file
"Error in 'eval' command: The arguments to the 'case' function are invalid."

| eval file=case(like('File Name',"evb%"),"EVB",'File Name') |table file
"The search job has failed due to an error"

Re: How to change a name within a field?

puneethgowda — Sat, 22 Apr 2017 02:42:58 GMT

Try replace commond!

Re: How to change a name within a field?

niketn — Sat, 22 Apr 2017 03:13:18 GMT

@happysplunkyay... Can you add some samples of filenames you have got? Do you have this filename as a field? if not you would need to provide a sample event. Also why you need to search for evbd and convert only EVB to upper case?

If your field containing file name is filename, then following should work:

<YourBaseSearch>  filename=CASE("evbd*")
| eval filename=replace(filename,"evb","EVB")