https://community.splunk.com/t5/Splunk-Search/how-to-use-a-wild-card-in-if-condition-in-eval/m-p/502808#M139921 <P>You cannot; you must use something else like <CODE>like</CODE> or <CODE>match</CODE> or <CODE>searchmatch</CODE> like this:</P> <PRE><CODE>... | eval Project=if(match(app, "^abc_"), "XYZ", "ZXT") </CODE></PRE> Tue, 24 Mar 2020 20:47:42 GMT woodcock 2020-03-24T20:47:42Z https://community.splunk.com/t5/Splunk-Search/how-to-use-a-wild-card-in-if-condition-in-eval/m-p/502807#M139920 <P>I have an eval condition as below which is working good.</P> <PRE><CODE>| eval Project=if(app=="abc_def_123", "XYZ", "ZXT") </CODE></PRE> <P>Now If I have given a wild card as shown below it's not working. How can I apply the wild card as shown below and get the required results?</P> <PRE><CODE>| eval Project=if(app=="abc_*", "XYZ", "ZXT") </CODE></PRE> Tue, 24 Mar 2020 20:32:32 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-a-wild-card-in-if-condition-in-eval/m-p/502807#M139920 pavanae 2020-03-24T20:32:32Z https://community.splunk.com/t5/Splunk-Search/how-to-use-a-wild-card-in-if-condition-in-eval/m-p/502808#M139921 <P>You cannot; you must use something else like <CODE>like</CODE> or <CODE>match</CODE> or <CODE>searchmatch</CODE> like this:</P> <PRE><CODE>... | eval Project=if(match(app, "^abc_"), "XYZ", "ZXT") </CODE></PRE> Tue, 24 Mar 2020 20:47:42 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-a-wild-card-in-if-condition-in-eval/m-p/502808#M139921 woodcock 2020-03-24T20:47:42Z