topic Re: How do I match based on multiple values using eval and like command in Splunk Search

How do I match based on multiple values using eval and like command

ezmo1982 — Thu, 25 Mar 2021 12:53:41 GMT

Hi,

I have a field named operating_system. it can contain multiple values examples being "Windows 10", "Windows Server 2016", "Windows 7" and others.

I want to set a field named os_group based on the value of operating_system. So if the value operating_system value contains "Windows Server*" i want to set the os_group to "Server". If the value of operating_system is "Windows 7", "Windows 8", or "Windows 10", I want to set os_group to "Workstation"

I was trying to do it using seperate lines as below. But can i combine these into one eval function where i can specify multiple values to filter on? I will need to use wildcards.

| eval os_group=if(like(operating_system, "%Server%", "Server", os_group)
| eval os_group=if(like(operating_system, "%Windows 7%", "Workstation", os_group)

Thanks

Re: How do I match based on multiple values using eval and like command

scelikok — Thu, 25 Mar 2021 12:55:34 GMT

Hi @ezmo1982,

You can use case statement;

| eval os_group=case(like(operating_system, "%Server%", "Server",like(operating_system, "%Windows 7%", "Workstation", 1=1, os_group)

Re: How do I match based on multiple values using eval and like command

ezmo1982 — Fri, 26 Mar 2021 18:10:53 GMT

Missing a ")" at the end of "%Server%" but apart from your spl does the job, thanks!