topic Re: IF Statement customized EVAL in Splunk Search

IF Statement customized EVAL

jerinvarghese — Mon, 25 Jan 2021 10:30:26 GMT

Hi All,

need help in my query, formatting an IF statement.

My Code:

My Output:

sitecode	nodelabel	Status	Time
ABM	ARABMLANCCO1	Up	1/23/2021 14:35
ABM	ARABMLANCUA1	Up	1/23/2021 8:26
ABM	ARABMLANCUA2	Up	1/23/2021 8:25
ABM	ARABMWANRTC1	Up	1/23/2021 8:25
ABM	ARABMLANCUA3	Up	1/23/2021 8:25
ABM	ARABMLANCUA4	Up	1/23/2021 8:25
ABM	ARABMAPNOPT1	Up	1/19/2021 13:37
ZBQ	BRZBQLANCUA1	Up	1/19/2021 13:37

Above table am getting from my code.

Requirement :

I want to list down all devices from that sitecode which have any of these name ("*WANRTC*" OR "*LANCCO*" OR "*WLNWLC*"OR "*APNINT*") these keyword in nodelabel. rest all site code should be removed from the list.

In my output. Am having ABM site which matches any of that Keyword and that to be displayed, where as ZBQ doesnt have any of that keyword devices in the list, so it should be removed.

like and IF ("*WANRTC*" OR "*LANCCO*" OR "*WLNWLC*"OR "*APNINT*") any of this present in device names, then the complete list to be displayed.

Re: IF Statement customized EVAL

renjith_nair — Mon, 25 Jan 2021 10:41:43 GMT

Does this help?

Re: IF Statement customized EVAL

jerinvarghese — Mon, 25 Jan 2021 11:03:09 GMT

This is filtering only devices which have "WANRTC|LANCCO|WLNWLC|APNINT". rest all devices from that site removed. I want other devices also from that site including the above one.

Re: IF Statement customized EVAL

renjith_nair — Mon, 25 Jan 2021 12:37:27 GMT

alright,

Try