topic Re: Like function overview? in Splunk Search

Like function overview?

jassikul — Tue, 29 Aug 2017 18:41:36 GMT

I am new to Splunk, Can someone please explain me what below query is doing and what does 1 mean at the end of Sourcetype and LIke and what 1=1.
Thanks in advance

| eval UseInSummary=case(
sourcetype="HTTP-RESULTS" AND Status="SUCCESS" AND Protocol="HTTP",1,

              like(Type,"packet_%") AND ResultCalculated=1,1,
              like(Type,"seeder_%") AND ResultCalculated=1 AND Result<200,1,
              Type="latent" AND ResultCalculated=1 AND Result<1000,1,
              1=1,0
            )

Re: Like function overview?

lfedak_splunk — Tue, 29 Aug 2017 18:48:55 GMT

Hey @jassikul, Here's documentation on like: http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/ConditionalFunctions

Re: Like function overview?

jassikul — Tue, 29 Aug 2017 19:03:19 GMT

Thanks Ifedak,

Does 1 means, Its creating a new column and assigning value 1 to matching conditions or like conditions.

Thanks

Re: Like function overview?

jassikul — Tue, 29 Aug 2017 19:07:58 GMT

Figured out, it assigns value as 1 and 1=1, 0 Rest everything else is 0.

Thanks

Re: Like function overview?

woodcock — Tue, 29 Aug 2017 19:27:34 GMT

The 1==1 is a simple way to generate a boolean value of true. The fully proper way to do this is to use true() which is much more clear. The reason that it is there is because it is a best-practice use of case to have a "catch-all" condition at the end, much like the default condition does in most programming languages that have a case command. The like command uses SQL syntax to generate a boolean ( true or a false ). So this saying: "assign "1" to UseInSummary whenever Type starts with the string packet_ AND ResultCalculated is 1 (that's just one line). So you do all the "positive" cases and then default 'UseInSummaryto0` otherwise. Proper spacing and linebreaking helps to provide clarity in Splunk; try this:

| eval UseInSummary=case(
       (sourcetype="HTTP-RESULTS" AND Status="SUCCESS" AND Protocol="HTTP"), 1,
       (like(Type,"packet_%") AND ResultCalculated=1),                       1,
       (like(Type,"seeder_%") AND ResultCalculated=1 AND Result<200),        1,
       (Type="latent" AND ResultCalculated=1 AND Result<1000),               1,
       true(),                                                               0)

Re: Like function overview?

jassikul — Tue, 29 Aug 2017 19:46:38 GMT

Thanks Woodcock, much appreciated your detailed response.

Thanks