topic Re: How do we use wildcard such as * in eval case match to see multiple types of files? in Splunk Search

How do we use wildcard such as * in eval case match to see multiple types of files?

sai_john — Tue, 29 Sep 2020 15:53:29 GMT

I was trying to give all the 6 types of files which are under fileName field and trying to get all the filetypes including * under FileType field. but with the below search i am not able to pull all 6types of files under FileType field.

Trying this search:
index=* | eval FileType=case(match(fileName,"ABC01.GIF*"),"ABC01.GIF*" , match(fileName,"ABC02.DCL*.GIF*"),"ABC02.DCL*.GIF*", match(fileName,"ABC03.IFG_DCL*.GIF*"),"ABC03.IFG_DCL*.GIF*", match(fileName,"ABC04.FGH_HCL*.DAT*"),"ABC04.FGH_HCL*.DAT*", match(fileName,"ABC05.FGH_OUT*.DAT*"), "ABC05.FGH_OUT*.DAT*", match(fileName,"ABC06.GHI_OUT_DAILY*.DAT*"), "ABC06.GHI_OUT_DAILY*.DAT*") | stats count by FileType

Please advise to get all types of files under FileType field.

Thanks!

Re: How do we use wildcard such as * in eval case match to see multiple types of files?

sai_john — Tue, 29 Sep 2020 15:53:32 GMT

My result values under FileType should be
FileType
"ABC01.GIF*"
"ABC02.DCL*.GIF*"
"ABC03.IFG_DCL*.GIF*"
"ABC04.FGH_HCL*.DAT*"
"ABC05.FGH_OUT*.DAT*"
"ABC06.GHI_OUT_DAILY*.DAT*"

Re: How do we use wildcard such as * in eval case match to see multiple types of files?

sbbadri — Wed, 20 Sep 2017 14:27:31 GMT

try this

| rex mode=sed "/*/ash/" | rest of the query instead of \* use ash

Re: How do we use wildcard such as * in eval case match to see multiple types of files?

somesoni2 — Wed, 20 Sep 2017 15:28:44 GMT

The match function in eval doesn't treat asterisk * as wildcard character but as regular expression. So the match fails. Try this

index= | eval FileType=case(match(fileName,"ABC01.GIF"),"ABC01.GIF*" , match(fileName,"ABC02.DCL.*.GIF.*"),"ABC02.DCL*.GIF*", match(fileName,"ABC03.IFG_DCL.*.GIF.*"),"ABC03.IFG_DCL*.GIF*", match(fileName,"ABC04.FGH_HCL.*.DAT.*"),"ABC04.FGH_HCL*.DAT*", match(fileName,"ABC05.FGH_OUT.*.DAT.*"), "ABC05.FGH_OUT*.DAT*", match(fileName,"ABC06.GHI_OUT_DAILY.*.DAT.*"), "ABC06.GHI_OUT_DAILY*.DAT*") | stats count by FileType

Re: How do we use wildcard such as * in eval case match to see multiple types of files?

lfedak_splunk — Wed, 20 Sep 2017 19:54:22 GMT

Hey @sai_john, if somesoni2's solution worked then please don't forget to accept their answer to award karma points and close the question. 🙂

Re: How do we use wildcard such as * in eval case match to see multiple types of files?

sai_john — Thu, 21 Sep 2017 00:10:03 GMT

I tried giving .. in between fileNames as you said but that is not working

Re: How do we use wildcard such as * in eval case match to see multiple types of files?

somesoni2 — Thu, 21 Sep 2017 00:19:36 GMT

Can you post some sample values of field fileName, especially the ones which are failing?

Re: How do we use wildcard such as * in eval case match to see multiple types of files?

sai_john — Fri, 22 Sep 2017 12:40:50 GMT

This worked. Thanks soni