topic Re: How to create a case statement with NOT LIKE option? in Splunk Search

How to create a case statement with NOT LIKE option?

zacksoft — Tue, 22 May 2018 09:24:08 GMT

| eval usage=case(like(_raw,"%FirstClass%"),"A_Grade",like(_raw,"%SecondClass%"),"B_Grade",like(_raw,"%ThirdClass%"),"C_Grade")

My question is, in the above statement when I draw a pie chart that gives me A, B, C_Grade. However I want to know all the failed student in the chart as well.
My _raw contains all the events i.e. all three grades and the failed student as well.
The logic to find that is, "If the _raw doesn't contain the string 'FirstClass' or 'SecondClass' or 'ThirdClass' , then whatever remaining in _raw is considered as 'Failed'. How do I implement this logic using case?

Re: How to create a case statement with NOT LIKE option?

xpac — Tue, 29 Sep 2020 19:36:07 GMT

Use this:

| eval usage=case(like(_raw,"%FirstClass%"),"A_Grade",like(_raw,"%SecondClass%"),"B_Grade",like(_raw,"%ThirdClass%"),"C_Grade", true(), "failed")

Case will take the first statement that is true, so the true() will be the last-case-fallback and return "failed" for all that did not meet any other criteria before.

Re: How to create a case statement with NOT LIKE option?

zacksoft — Tue, 29 Sep 2020 19:39:45 GMT

Thanks @xpac.
But it only returns me the events that are "failed". It won't return me A_Grade, B_Grade, C_Grade data !

Re: How to create a case statement with NOT LIKE option?

FrankVl — Tue, 22 May 2018 14:29:10 GMT

That approach to put a true(),"failed" option at the end of the case statement is perfectly valid though. Can you post the exact code you tested with? Please post it as code (using the 101010 button).

Re: How to create a case statement with NOT LIKE option?

xpac — Tue, 22 May 2018 14:31:37 GMT

If that's the case, it's an issue with the rest of your query. Eval never filters anything out.

Re: How to create a case statement with NOT LIKE option?

niketn — Tue, 22 May 2018 14:49:48 GMT

@zacksoft, you can use searchmatch() to find pattern in raw events (ideally you should create field extractions).
As per the question you have case() conditions to match A, B and C grades and everything else is supposed to be considered as Failed. So, you can use true() or 1==1 condition in the case() statement to defined unmatched events as Failed. Please try the following run anywhere search and confirm:

| makeresults 
| eval data="FirstClass;SecondClass;ThirdClass;Others"
| makemv data delim=";"
| mvexpand data
| rename data as _raw
| eval usage=case(searchmatch("FirstClass"),"A_Grade",searchmatch("SecondClass"),"B_Grade",searchmatch("ThirdClass"),"C_Grade",true(),"Failed")

Re: How to create a case statement with NOT LIKE option?

zacksoft — Tue, 22 May 2018 15:04:53 GMT

Absolutely brilliant. Thank you very much. The solution you provided does exactly what I wanted.

Re: How to create a case statement with NOT LIKE option?

niketn — Tue, 22 May 2018 15:07:55 GMT

@zacksoft, glad it worked 🙂 Accept the answer to mark this question as answered!