topic Using Eval to Filter Values in Splunk Search

Using Eval to Filter Values

jason_hotchkiss — Thu, 27 Jan 2022 23:40:29 GMT

Hello Splunkers -

I am trying to filter any value that is wrapped in $, such as $host$or $value$. I thought the below would work, but it is not. Can someone point out what I am doing wrong? Thanks!

| eval dollar_sign=if(host_value=="$host$" OR host_value=="$value$", "yes", "no")
| search NOT dollar_sign=yes

Re: Using Eval to Filter Values

johnhuang — Fri, 28 Jan 2022 01:27:42 GMT

| eval dollar_sign=IF(LIKE(host_value, "$%$"), "yes", "no")

Re: Using Eval to Filter Values

ITWhisperer — Fri, 28 Jan 2022 08:03:54 GMT

If you are using this in a dashboard, the dollar signs have to be doubled up otherwise it is looking for tokens

| eval dollar_sign=if(host_value=="$$host$$" OR host_value=="$$value$$", "yes", "no") | search NOT dollar_sign=yes

Re: Using Eval to Filter Values

jason_hotchkiss — Fri, 28 Jan 2022 13:56:36 GMT

This solved my use case. Thank you @johnhuang

Re: Using Eval to Filter Values

jason_hotchkiss — Fri, 28 Jan 2022 13:57:30 GMT

I will keep this in mind if I end up using this in a dashboard. Thank you @ITWhisperer