topic Re: Why is the splunk eval case with special characters not working? in Splunk Search

Why is the splunk eval case with special characters not working?

Chandras11 — Tue, 29 Sep 2020 20:24:00 GMT

Hi everyone,

when I try to use the following command, it always gives in CA_flag as "Other" although lower_Ticket_Desc has a exact maching term. Is there something, which I am not doing correctly here :

| eval lower_Ticket_Desc = lower(TICKET_DESC)| rex field=lower_Ticket_Desc mode=sed "s/ //g"|eval CA_flag = case(lower_Ticket_Desc=="[yes/no]:no" ,"Flag_NO" ,lower_Ticket_Desc=="[yes/no]:yes"  ,"Flag_YES" , 1=1, "Other" )  |

I have removed all blank spaces and converted everything to lower case.

TICKET_DESC example = "asdfjkasdhf [Yes/No]: No dfasjaskl" Or "asdfjkasdhf [Yes/No]:no asdfadsf" or "asdfjkasdhf [Yes/No]: YES asdfadsf"

Re: Why is the splunk eval case with special characters not working?

FrankVl — Tue, 10 Jul 2018 13:29:48 GMT

That's because your case statement uses == comparison operator, which requires an exact match. While your match string is a substring of the actual field value.

Try the following using like() and adding % signs before and after the match string:

| eval lower_Ticket_Desc = lower(TICKET_DESC) 
| rex field=lower_Ticket_Desc mode=sed "s/ //g" 
| eval CA_flag = case(like(lower_Ticket_Desc,"%[yes/no]:no%") ,"Flag_NO" ,like(lower_Ticket_Desc,"%[yes/no]:yes%") ,"Flag_YES" , 1=1, "Other" )

Re: Why is the splunk eval case with special characters not working?

Chandras11 — Tue, 10 Jul 2018 13:39:46 GMT

Thanks Frank.. you reduced one common mistake, which I do regularly 🙂

Re: Why is the splunk eval case with special characters not working?

niketn — Tue, 10 Jul 2018 13:46:57 GMT

@Chandras11, please try the following case() statement

| eval CA_flag = case(match(lower_Ticket_Desc,"^\[yes\/no\]:no$") ,"Flag_NO",
                     match(lower_Ticket_Desc,"^\[yes\/no\]:yes$") ,"Flag_YES",
                     1=1, "Other")

Following is a run anywhere search for testing:

| makeresults 
| eval lower_Ticket_Desc="[yes/no]:yes" 
| eval CA_flag = case(match(lower_Ticket_Desc,"^\[yes\/no\]:no$") ,"Flag_NO",
                 match(lower_Ticket_Desc,"^\[yes\/no\]:yes$") ,"Flag_YES",
                 1=1, "Other")

Re: Why is the splunk eval case with special characters not working?

niketn — Tue, 10 Jul 2018 13:48:02 GMT

@FrankVl, nothing new... again you beat me to it. I posted a different approach but too late 😉

Re: Why is the splunk eval case with special characters not working?

Chandras11 — Tue, 10 Jul 2018 13:50:21 GMT

@niketnilay : Its always good to have more than one approach:)

Re: Why is the splunk eval case with special characters not working?

FrankVl — Tue, 10 Jul 2018 13:54:44 GMT

I don't think those regular expressions are correct, given that the field values look like this (according to his examples): "asdfjkasdhf [Yes/No]: No dfasjaskl"

If your regex would have been correct, then his original == would also have worked, right?

Just remove the ^ and $ signs and it would work.