topic Re: eval match with NOT condition in Splunk Search

eval match with NOT condition

kmaron — Thu, 19 Apr 2018 20:24:21 GMT

I've figured out how to use the match condition to use a wildcard in my eval, however now I need to put at NOT with it and I'm stuck.

I have this which works

| eval NewDocType = case(match(Indexer,"ID*"),Document_Type)

But now I need the opposite where Indexer does NOT start with ID* to fill the field OriginalDocType with the Document_Type

Re: eval match with NOT condition

somesoni2 — Thu, 19 Apr 2018 20:49:12 GMT

Just do like this

| eval NewDocType = case(NOT match(Indexer,"^ID"),Document_Type)

With match you can do partial match, no wildcard required. It actually uses regular expression (not like search wildcard), so your current expression will match all Indexer with which have ID* (0 or more occurrence of alphabet D)

Re: eval match with NOT condition

niketn — Thu, 19 Apr 2018 21:58:09 GMT

@kmaron, try the following match condition for finding indexers not starting with ID:

| eval OriginalDocType=case(match(indexer,"^(?!^ID).*"),DocumentType)

Following is a run anywhere example.

| makeresults
| fields - _time
| eval indexer="ID3489724,SID203984,IDKJERH897,ADID90842ID"
| makemv indexer delim=","
| mvexpand indexer
| eval DocumentType="Test"
| eval OriginalDocType=case(match(indexer,"^(?!^ID).*"),DocumentType)

Re: eval match with NOT condition

kmaron — Fri, 20 Apr 2018 11:55:07 GMT

It seems so simple to just stick a NOT in there. Thank you for explaining about match!

Re: eval match with NOT condition

kmaron — Fri, 20 Apr 2018 11:57:07 GMT

When I ran this your way and then with the NOT that @somesoni2 mentioned the NOT came out a tiny bit faster but it's extremely fast in my tiny search anyway so the difference is negligible. Do you know which one would be more efficient?

Re: eval match with NOT condition

niketn — Fri, 20 Apr 2018 12:16:11 GMT

@kmaron Use Job Inspector with some significant amount of data to test out the performance.

Re: eval match with NOT condition

niketn — Fri, 20 Apr 2018 12:16:59 GMT

@kmaron, to mark this question as answered, please accept the answer if this has helped.