topic Re: EVAL Command Help in Splunk Search

EVAL Command Help

Marco — Fri, 04 Dec 2020 23:33:32 GMT

Hello Splunkers,

I am trying to write is a condition that says if command starts with "CHA" or "INS" add one.

The Query:

host=*| eval AUDIT=if(like(COMMAND,"CHA % AUDIT%", "INS % AUDIT%"),1,0)| stats sum(AUDIT)

Not combining the conditions get me a working query EX:

host=* | eval AUDIT=if(like(COMMAND,"CHA % AUDIT%"),1,0)|stats sum(AUDIT)

Is there a way I can get the query working?

richgalloway — Mon, 07 Dec 2020 15:27:32 GMT

The solution is in the question.

I am trying to write is a condition that says if command starts with "CHA" or "INS" add one.

host=* | eval AUDIT=if(like(COMMAND,"CHA % AUDIT%") OR like(COMMAND,"INS % AUDIT%"),1,0) | stats sum(AUDIT)

Marco — Mon, 07 Dec 2020 15:25:46 GMT

After trying the query, I get and error message stating:

"Error in 'eval' command: The arguments to the 'like' function are invalid."

-Marco

richgalloway — Mon, 07 Dec 2020 15:27:46 GMT

I've fixed my answer.

Marco — Mon, 07 Dec 2020 15:38:38 GMT

Thank you so much,

I've been trying to figure that out for hours. 🙏