topic Re: Eval Condition Search in Splunk Search

Eval Condition Search

kpavan — Wed, 30 Sep 2020 05:04:31 GMT

Hi,

Am looking for conditional eval search for my results, could you please help me with correct query.

index=myindex source="access" api="sendverification?email=*&op=passwordrecovery" OR api="*reset-password.html" OR api="*updatepassword" response_code=200 OR response_code=400
| eval API=case(api LIKE "%op=passwordrecovery", "Request Password Reset", api LIKE "%reset-password.html", "Email Link", api LIKE "%updatepassword", "updatepassword")
| chart count by API

but api=updatepassword has response_code 200(success) and 400(failure), i need to display api updatepassword, response_code 200 as success and api updatepassword, response_code 400 as failure

as result i need display all four api account with count like

Date, API, Count
2020-04-22, Request Password Reset, 10
2020-04-22, Email Link, 5
2020-04-22, Success, 9
2020-04-22, Failure, 1

Thanks!
Pavan

Re: Eval Condition Search

manjunathmeti — Wed, 22 Apr 2020 16:06:42 GMT

hi @kpavan,

Try this.

index=myindex source="access" api="sendverification?email=*&op=passwordrecovery" OR api="*reset-password.html" OR api="*updatepassword" response_code=200 OR response_code=400
| eval API=case(like(api, "%op=passwordrecovery"), "Request Password Reset", like(api, "%reset-password.html"), "Email Link", like(api, "%updatepassword"), if(response_code == 200, "Success", "Failure"))
| chart count by API

Re: Eval Condition Search

kpavan — Thu, 23 Apr 2020 08:10:49 GMT

Thank you much @manjunathmeti !