topic Re: How do you use the eval command when the field value contains multiple variables? in Splunk Search

How do you use the eval command when the field value contains multiple variables?

jacqu3sy — Tue, 05 Feb 2019 10:50:20 GMT

Hi,

How do I use the eval statement when the field value could contain multiple variables?

so for example my field "OS" could be;

Windows XP
Windows 7
Windows 10
Server 2003
Server2008

I want to use an eval to create two new fields; one for server OS and another for desktop OS

So something like

| eval server=if(OS="Server 2003" OR OS="Server2008")
| eval desktop=if(OS="Windows XP" OR OS="Windows 10")

Thanks.

Re: How do you use the eval command when the field value contains multiple variables?

DMohn — Tue, 05 Feb 2019 10:56:16 GMT

You could use either match or like as an eval function here ...

 | eval is_server = if(like(OS, "Server%"),"1","0")
 | eval is_desktop = if(like(OS, "Windows%"),"1","0")

Like uses a SQL-like wildcard matching. You can get even more flexibility with match - which uses regex...

 | eval is_server = if(match(OS, "Server\s?[\d]{4}"),"1","0")
 | eval is_desktop = if(like(OS, "Windows"),"1","0")

Hope this helps ...

Re: How do you use the eval command when the field value contains multiple variables?

harsmarvania57 — Tue, 05 Feb 2019 10:57:53 GMT

Hi,

Try case

<yourBaseSearch>
| eval os_type=case(OS == "Windows XP" OR OS == "Windows 7" OR OS == "Windows 10", "desktop", OS == "Server 2003" OR OS == "Server2008", "server")

Re: How do you use the eval command when the field value contains multiple variables?

jacqu3sy — Tue, 05 Feb 2019 11:08:10 GMT

worked like a charm. thanks.

Re: How do you use the eval command when the field value contains multiple variables?

harsmarvania57 — Tue, 05 Feb 2019 11:47:23 GMT

Great, you are welcome