https://community.splunk.com/t5/Splunk-Search/Help-with-eval-and-wildcards/m-p/407755#M117755 <P>Hi @a212830,<BR /> try to use like instead match</P> <PRE><CODE>index=main sourcetype=sensor_info | eval IDSGROUP = case(like(host,"az%"), "Tuscon RIG", like(host,"bos%"), "Boston RIG", like(host,"tx%"), "DFW RIG", like(host,"ca%"), "LAX RIG") | timechart avg(pkt_drop_percent) by host </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Fri, 26 Jul 2019 14:06:45 GMT gcusello 2019-07-26T14:06:45Z https://community.splunk.com/t5/Splunk-Search/Help-with-eval-and-wildcards/m-p/407754#M117754 <P>Hi,</P> <P>I'm trying to use eval for hosts, and need to use wildcards. I tried the following, but it's not working. How does eval handle wildcards?</P> <PRE><CODE>index=main sourcetype=sensor_info | eval IDSGROUP = case(match(host==az*, "Tuscon RIG", host==bos*, "Boston RIG", host==tx*, "DFW RIG", host==ca*, "LAX RIG")) | timechart avg(pkt_drop_percent) by host </CODE></PRE> Fri, 26 Jul 2019 13:55:11 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-eval-and-wildcards/m-p/407754#M117754 a212830 2019-07-26T13:55:11Z https://community.splunk.com/t5/Splunk-Search/Help-with-eval-and-wildcards/m-p/407755#M117755 <P>Hi @a212830,<BR /> try to use like instead match</P> <PRE><CODE>index=main sourcetype=sensor_info | eval IDSGROUP = case(like(host,"az%"), "Tuscon RIG", like(host,"bos%"), "Boston RIG", like(host,"tx%"), "DFW RIG", like(host,"ca%"), "LAX RIG") | timechart avg(pkt_drop_percent) by host </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Fri, 26 Jul 2019 14:06:45 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-eval-and-wildcards/m-p/407755#M117755 gcusello 2019-07-26T14:06:45Z https://community.splunk.com/t5/Splunk-Search/Help-with-eval-and-wildcards/m-p/407756#M117756 <P>Thanks! !!</P> Fri, 26 Jul 2019 15:39:33 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-eval-and-wildcards/m-p/407756#M117756 a212830 2019-07-26T15:39:33Z https://community.splunk.com/t5/Splunk-Search/Help-with-eval-and-wildcards/m-p/407757#M117757 <P>You're welcome!<BR /> Bye.<BR /> Giuseppe</P> Sat, 27 Jul 2019 14:52:16 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-eval-and-wildcards/m-p/407757#M117757 gcusello 2019-07-27T14:52:16Z https://community.splunk.com/t5/Splunk-Search/Help-with-eval-and-wildcards/m-p/407758#M117758 <P>First you need to have your pattern wrapped in quotes.</P> <P>Two, you need to use match() properly.</P> <P>Then you need to fix your regex. </P> <P>You probably want something like <CODE>case(match(host,”az.*”),”Tuscon”,match(host,”bos.*”),”Boston”)</CODE> for a shortened example</P> Mon, 29 Jul 2019 03:00:36 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-eval-and-wildcards/m-p/407758#M117758 twinspop 2019-07-29T03:00:36Z