topic Help using eval case statement using wildcards in Splunk Search

Help using eval case statement using wildcards

johnward4 — Fri, 17 May 2019 23:06:08 GMT

I'm trying to create a new field for category based off values in my existing 'message' field.

index=network sourcetype=test
| eval category = case (like(message,"*port scan detected*"), "Network_Port_Scan", like(message,"Gateway Anti-Virus Alert*"), like(message,"*Possible TCP Flood*")), "Network_Threat_Activity", like(message,"*packet dropped*" like(message,"*connection dropped*" like(message,"*protocol dropped*"))), "Network_Wire_Activity")

Does anyone know how I accomplish this?

Re: Help using eval case statement using wildcards

woodcock — Fri, 17 May 2019 23:11:53 GMT

Asterisks are wild only for search and base searches. For eval and where, they are string literals so you MUST use something else like, like() or match().

Re: Help using eval case statement using wildcards

johnward4 — Wed, 30 Sep 2020 00:35:59 GMT

@woodcock can I using OR operators inside a given like() statement?

example :

| eval category = case (like(message,"%port scan detected%"), "Network_Port_Scan", like(message,"%Gateway Anti-Virus Alert%" OR "%TCP Flood%"), "Network_Threat_Activity")

Re: Help using eval case statement using wildcards

woodcock — Sat, 18 May 2019 00:13:49 GMT

No but you can like() OR like() and you can use SQL boolean syntax or use match(message, "foo|bar|bat").