topic Re: Case condition check issue in Splunk Search

Case condition check issue

mugilbala — Mon, 11 Jun 2018 13:42:08 GMT

Application logs execution time for many apis. I am interested in 2 apis with following urls.
/apis/deviceservice/2.0/accounts/acountid/devices
/apis/deviceservice/2.0/accounts/devices/deviceId

I am trying to print a report with following query.

index="xyz" source="*access.log"
| eval Service=case(
Url like ("%/apis/deviceservice/2.0/accounts/devices/%") AND Method="GET", "Get Specific Device",
Url like ("%/apis/deviceservice/2.0/accounts/%/devices"), "Get Devices Account Level",

true(), Url )
| table ExternalId, Time, Service | xyseries ExternalId Service Time

How ever, "Url like ("%/apis/deviceservice/2.0/accounts/%/devices")" condition is not working as expected and prints the full url with different account ids.

Can you help me with the correct condition to achieve the result?

Re: Case condition check issue

vasanthmss — Mon, 11 Jun 2018 17:10:02 GMT

post some sample data.

Re: Case condition check issue

niketn — Tue, 12 Jun 2018 06:35:08 GMT

[UPDATED ANSWER]
Based on raw events provided, you would need to use following updated match() condition. .* has been added as beginning pattern.

@mugilbala you can use following match() eval function instead of like to use regular expression based pattern match.

| makeresults
| eval data="2018-06-12 07:40:45,643 GMT DEBUG Bytes=3653|HttpStatus=200|Method=GET|Time=42|Url=https://hostip/apis/deviceservice/2.0/accounts/devices/9930cf66-3480-4e7a-b31b-539287dfcd10|LogMessage=HTTP 200;2018-06-12 07:40:45,643 GMT DEBUG Bytes=3653|HttpStatus=200|Method=GET|Time=45|Url=https://hostip/apis/deviceservice/2.0/accounts/e7546806-a507-49dc-853c-7dcae1a85f92/devices|LogMessage=HTTP 200;2018-06-12 07:40:45,644 GMT DEBUG Bytes=3653|HttpStatus=200|Method=GET|Time=38|Url=https://hostip/apis/deviceservice/2.0/accounts/devices/9930cf66-3480-4e7a-b31b-539287dfcd10|LogMessage=HTTP 200;2018-06-12 07:40:45,708 GMT DEBUG Bytes=3653|HttpStatus=200|Method=GET|Time=71|Url=https://hostip/apis/deviceservice/2.0/accounts/e7546806-a507-49dc-853c-7dcae1a85f92/devices|LogMessage=HTTP 200;2018-06-12 07:41:45,689 GMT DEBUG Bytes=3653|HttpStatus=200|Method=GET|Time=28|Url=https://hostip/apis/deviceservice/2.0/accounts/devices/9930cf66-3480-4e7a-b31b-539287dfcd10|LogMessage=HTTP 200"
| makemv data delim=";"
| mvexpand data
| rename data as _raw
| KV
| eval Service=case( 
     match(Url,".*\/apis\/deviceservice\/2\.0\/accounts\/devices\/"), "Get Specific Device", 
     match(Url,".*\/apis\/deviceservice\/2\.0\/accounts\/[^\/]+\/devices"), "Get Devices Account Level",
     true(), Url )

Re: Case condition check issue

mugilbala — Tue, 12 Jun 2018 14:01:05 GMT

Hi,
Thanks for quick response. I have added sample data. I tried your suggestion and it did not work. Can you please check the sample data provided and let me know if any change is required for the search query?

Thank you.

Re: Case condition check issue

mugilbala — Tue, 12 Jun 2018 14:01:50 GMT

Hi,
I have added some sample data. Please check.

Re: Case condition check issue

niketn — Wed, 13 Jun 2018 02:25:23 GMT

Please try the updated answer as per your question following is the regular expression based match() you need:

  <yourCurrentSearch>
 | eval Service=case( 
      match(Url,".*\/apis\/deviceservice\/2\.0\/accounts\/devices\/"), "Get Specific Device", 
      match(Url,".*\/apis\/deviceservice\/2\.0\/accounts\/[^\/]+\/devices"), "Get Devices Account Level",
      true(), Url )

Re: Case condition check issue

mugilbala — Wed, 13 Jun 2018 14:49:41 GMT

Thank you. It worked as needed. Appreciate your help.