topic Re: eval with wildcard in Splunk Search

eval with wildcard

Mike6960 — Tue, 18 Feb 2020 16:02:21 GMT

I am trying to use an eval but there is a wildcard so I noticed this does not work. Ho can I get this to work? I tried using match or Like but I cant get it working

......count(eval(logger ="blablabla test HTTP status: 200.")) OR logger="something id * HTTP status: 200") AS Example

Re: eval with wildcard

nickhills — Tue, 18 Feb 2020 16:33:23 GMT

Try
|stats count(eval(like(logger,"%status: 200"))) as Example

Re: eval with wildcard

Mike6960 — Tue, 18 Feb 2020 17:08:48 GMT

Hi, what does 'category' do ?

Re: eval with wildcard

nickhills — Tue, 18 Feb 2020 17:16:41 GMT

sorry - should have been logger - amended in the answer.

Re: eval with wildcard

kamlesh_vaghela — Wed, 19 Feb 2020 08:57:04 GMT

@Mike6960

You can try this also.

YOUR_SEARCH | eval example= case(like(logger,"blablabla test HTTP status: 200."),1,like(logger,"something id % HTTP status: 200"),1,1=1,0) | stats sum(example) as example

Sample:

| makeresults 
| eval logger="blablabla test HTTP status: 200.|something id 1234 HTTPA status: 200|something id 1234 HTTP status: 200", logger=split(logger,"|") 
| mvexpand logger
| rename comment as "Upto this is for data generation only" 
| eval example= case(like(logger,"blablabla test HTTP status: 200."),1,like(logger,"something id % HTTP status: 200"),1,1=1,0)
| stats sum(example) as example

Re: eval with wildcard

manjunathmeti — Wed, 19 Feb 2020 10:00:38 GMT

If you are counting logs with status code 200, then extract status from logger and count it. You can use extracted field to count logs with other status codes also.

| rex field=logger "status:\s(?<status>[\d]+)" | stats count(eval(status=200)) AS count

Re: eval with wildcard

shashank_24 — Wed, 01 Dec 2021 23:57:11 GMT

This works like a charm. Thanks