topic Re: Where's Where's Wildcarding? in Splunk Search

Where's Where's Wildcarding?

code_monkey — Wed, 06 Jun 2012 22:24:11 GMT

| where $click.name$ == if("$click.value$" == "Totals", * , "$click.value$")

This bit of code is intended to allow us to use a drill-down on a table that includes a generated row where the clicked value or the clicked value's field name may not be descriptive search terms, specifically a row of column totals. Obviously, it doesn't work.

Where appears to lack the wildcarding semantic entirely, which makes sense I suppose. However, I rather need that bit of functionality.
A bare * isn't really a valid return value here, a quoted one becomes a useless string literal, and an escaped one doesn't work either.

I was wondering if anyone had a better approach to this kind of last-minute substitution-chicanery, or if anyone knows how to get a match-any boolean expression out of a where clause?

Re: Where's Where's Wildcarding?

ziegfried — Thu, 07 Jun 2012 10:49:01 GMT

As far as I've understood your intention, you could probably do it this way:

... | where if("$click.value$" == "Totals", true(), $click.name$ == "$click.value$")

Edit:

Here's how you could use the eval command to create conditions for a search:

<some search conditions> [ | stats count | eval search=if("$click.value$" == "Totals", "*", "$click.name$=\"$click.value$\"") | fields search ]

The subsearch (within the square brackets) will expand to an additional search condition for the outer search. (The stats count part is just used to great a single result, thats rather hack/workaround)

Re: Where's Where's Wildcarding?

code_monkey — Thu, 07 Jun 2012 13:21:15 GMT

That does solve it, since where just wants a boolean. I'm still curious about how I'd return something like a wildcard or other non-string value.

Re: Where's Where's Wildcarding?

ziegfried — Thu, 07 Jun 2012 13:26:24 GMT

The where command doesn't "return" anything. It will simply remove those results where the expression evaluates to false. You can use the eval command to create new fields.

Re: Where's Where's Wildcarding?

ziegfried — Thu, 07 Jun 2012 13:31:18 GMT

I've added an example on how you could use the eval command to create conditions for a search query.