topic Re: How to use a Boolean string from lookup table in search in Splunk Search

How to use a Boolean string from lookup table in search

skadirov1 — Tue, 17 Apr 2018 00:16:43 GMT

I have Boolean string with multiple ORs- code!=x OR code!=y OR etc. When I look it up and use in search it evaluates to string and not Boolean in the eval function. I get error message that a Boolean was expected. Is there a way to force a string to evaluate to Boolean? The string works fine when defined as macro, but I need it in the lookup. Thanks

Re: How to use a Boolean string from lookup table in search

p_gurav — Tue, 17 Apr 2018 04:46:43 GMT

Can you give sample data?

Re: How to use a Boolean string from lookup table in search

knielsen — Tue, 17 Apr 2018 11:01:07 GMT

It would be easier if you give a search as example.

You might be able to get what you need by using the "return" function.

In this example, result will be "ok", because the string "foo=\"something\" OR foo=\"whatever\"" will be turned into a boolean expression by return:

| makeresults | eval foo="something" | eval result=if([|makeresults | eval string="foo=\"something\" OR foo=\"whatever\""|return $string],"ok","nok")

So your lookup would go into the if clause, finished by a return.

Hth,
Kai.

Re: How to use a Boolean string from lookup table in search

skadirov1 — Tue, 17 Apr 2018 13:57:19 GMT

Sure.
-code=123
-code=456
-code=789

Splunk Error='Typechecking failed. 'OR' only takes boolean arguments.'

for count(eval(errorsToExclude OR TIME>1000))

In the lookup
errorsToExclude=code!=1 OR code!=2 ...

Re: How to use a Boolean string from lookup table in search

skadirov1 — Tue, 17 Apr 2018 15:18:02 GMT

Thanks Kai. What is makeresult? The string with boolean ORs comes from lookup acvsfile errortype OUTPUT errorsToExclude. How can i pass errorsToExclude into eval(errorsToExclude OR TIME>1000))?