https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-do-an-eval-match-and-if-so-to-plot-a/m-p/372529#M109574 <P>@howardroark, You can do wildcard search in the base query which should still be faster than an eval later:</P> <PRE><CODE> index="ABC" cs_uri_stem="XYZ" cs_uri_query="*content*" | timechart avg(time_taken) as AvgTime </CODE></PRE> Thu, 29 Jun 2017 03:42:52 GMT niketn 2017-06-29T03:42:52Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-do-an-eval-match-and-if-so-to-plot-a/m-p/372526#M109571 <P>I am trying to plot a timechart with a the following</P> <PRE><CODE>index="ABC" cs_uri_stem = "XYZ" | timechart eval( if(match(cs_uri_query,"A"),avg(time_taken))) as AvgTime by cs_uri_stem </CODE></PRE> <P>Basically, I am trying to match a string in a sentence and based on that if its found then take the average time_taken else do nothing.</P> <P>How can I achieve this?</P> Tue, 27 Jun 2017 20:34:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-do-an-eval-match-and-if-so-to-plot-a/m-p/372526#M109571 howardroark 2017-06-27T20:34:28Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-do-an-eval-match-and-if-so-to-plot-a/m-p/372527#M109572 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/30125">@howardroark</a>, if you do nothing in the else block then you are complicating your use case. You can just filter the required events i.e. cs_uri_query="A" in your base search itself (which will also return results faster). Further you do not need <CODE>by cs_uri_stem</CODE> since you are anyways filtering to only one record in base search i.e. "XYZ"</P> <PRE><CODE> index="ABC" cs_uri_stem="XYZ" cs_uri_query="A" | timechart avg(time_taken) as AvgTime </CODE></PRE> Tue, 29 Sep 2020 14:39:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-do-an-eval-match-and-if-so-to-plot-a/m-p/372527#M109572 niketn 2020-09-29T14:39:56Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-do-an-eval-match-and-if-so-to-plot-a/m-p/372528#M109573 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/201110">@niketn</a> Sure, though its not the complete cs_uri_query that i am interested in. I am interested in a keyword present in the query string. Can I filter out based on that. Say "content" keyword in "type=content&amp;source=%size%" cs_uri_query?</P> Tue, 29 Sep 2020 14:36:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-do-an-eval-match-and-if-so-to-plot-a/m-p/372528#M109573 howardroark 2020-09-29T14:36:03Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-do-an-eval-match-and-if-so-to-plot-a/m-p/372529#M109574 <P>@howardroark, You can do wildcard search in the base query which should still be faster than an eval later:</P> <PRE><CODE> index="ABC" cs_uri_stem="XYZ" cs_uri_query="*content*" | timechart avg(time_taken) as AvgTime </CODE></PRE> Thu, 29 Jun 2017 03:42:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-do-an-eval-match-and-if-so-to-plot-a/m-p/372529#M109574 niketn 2017-06-29T03:42:52Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-do-an-eval-match-and-if-so-to-plot-a/m-p/372530#M109575 <P>Also you can perform match during stats/timechart command using eval</P> <PRE><CODE> index="ABC" cs_uri_stem="XYZ" cs_uri_query="*content*" | timechart avg(eval(match(cs_uri_query,"content"))) as AvgTime </CODE></PRE> <P>However, avg is depended on number of buckets of time where cs_uri_query matched as expected. So you might have to get count instead of avg and compute avg based on number of buckets instead.</P> Tue, 29 Sep 2020 14:43:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-do-an-eval-match-and-if-so-to-plot-a/m-p/372530#M109575 niketn 2020-09-29T14:43:43Z