topic Conditional searching using eval command with if match in Splunk Search

Conditional searching using eval command with if match

mdeterville — Wed, 30 Sep 2020 04:30:19 GMT

Hi SMEs:

I would like to define a print event type to differentiate Remote Prints from Office Print jobs.

From my print logs, i'd like to:

Define channel = "Remote Print", where printer name contains "WING*RCA" else, "Office Print".

I started off with:
| eval channel = if(match(like printer="WING*RCA", "Remote Print"), "Office Print")

I'm still relatively new to these commands and would appreciate any assistance.

Thanks in advance,
Mac

Re: Conditional searching using eval command with if match

anmolpatel — Fri, 06 Mar 2020 02:25:42 GMT

If the name is WING[digit]RCA you can go with

| makeresults 
| eval raw = "Printer1%WING1RCA%;Printer2%WING2RCA;Printer3%WING;Printer4%RCA" 
| makemv raw delim=";" 
| mvexpand raw 
| rex field=raw "(?P<Printer>[^\%]+)%(?P<Location>[^\%]+)" 
| eval channel = if(match(Location, "WING\dRCA"), "Remote Office", "Office")
| table Printer Location channel

If there is more text in between, WING[text]RCA, you can break it down to

| eval channel = if(match(Location, "WING.*"), if(match(Location, ".*RCA"), "Remote Office", "Office"), "Office")

Re: Conditional searching using eval command with if match

mdeterville — Fri, 06 Mar 2020 02:50:06 GMT

Thanks anmol.

The printer name typically looks like eg. Canon MF4770n (from WING_000.0.000.0-RCA).

Re: Conditional searching using eval command with if match

anmolpatel — Fri, 06 Mar 2020 03:05:50 GMT

If the printer is an extracted key, the solution i've provided above will solve your query. Just change the variables as required.

Re: Conditional searching using eval command with if match

manjunathmeti — Fri, 06 Mar 2020 07:35:42 GMT

You can use both like and match functions with eval command to

like(FIELD, PATTERN)
This function returns TRUE if FIELD values matches the PATTERN.
In PATTERN, you can use use the percent ( % ) symbol as a wildcard for multiple characters and use the underscore ( _ ) character for a single character match.
match(FIELD, "REGEX")
This is is regex based function and returns TRUE or FALSE based on whether REGEX matches FIELD values.

So both queries below returns same results:

| makeresults | eval printer ="Canon MF4770n (from WING_000.0.000.0-RCA)" | eval channel = if(match(printer, "WING.*RCA"), "Remote Print", "Office Print")

| makeresults | eval printer ="Canon MF4770n (from WING_000.0.000.0-RCA)" | eval channel = if(like(printer, "%WING%RCA%"), "Remote Print", "Office Print")