topic Re: Search for field range of numbers inside of case statement in Splunk Search

Search for field range of numbers inside of case statement

rberkheimer — Tue, 10 Sep 2019 16:41:18 GMT

Greetings!

Hoping there is an easier way to write this sequential host list such as (host = "vlt(01 through 16)-she1") ?

| eval cde_model = case (
host = "vlt01-she1" OR host = "vlt02-she1" OR host = "vlt03-she1" OR host = "vlt04-she1" OR host = "vlt05-she1" OR host = "vlt06-she1" OR host = "vlt07-she1" OR host = "vlt08-she1" OR host = "vlt09-she1" OR host = "vlt10-she1" OR host = "vlt11-she1" OR host = "vlt12-she1" OR host = "vlt13-she1" OR host = "vlt14-she1" OR host = "vlt15-she1" OR host = "vlt16-she1", "cde-460-she1",

host = "vlt181-she1" OR host = "vlt182-she1" OR host = "vlt183-she1" OR host = "vlt184-she1" OR host = "vlt185-she1" OR host = "vlt186-she1" OR host = "vlt187-she1" OR host = "vlt188-she1" OR host = "vlt189-she1" OR host = "vlt190-she1" OR host = "vlt191-she1" OR host = "vlt192-she1" OR host = "vlt193-she1" OR host = "vlt194-she1" OR host = "vlt195-she1" OR host = "vlt196-she1" OR host = "vlt197-she1" OR host = "vlt198-she1", "cde-475-she1",

1=1, "oops"
)

Re: Search for field range of numbers inside of case statement

masonmorales — Tue, 10 Sep 2019 17:56:10 GMT

Try this:

| rex field=host (?<cde_model>vlt0*([1-9]|1[0-6])-she1)
| search cde_model=*

Re: Search for field range of numbers inside of case statement

rberkheimer — Tue, 10 Sep 2019 18:13:03 GMT

Hmmm didn't think of rexing, thx for the input.

errors with:
Unknown search command '1'.