How do I combine two searches in an eval command?

KyleMcDougall — Thu, 15 Sep 2022 16:58:12 GMT

Hello,

How do I combine two searches in an eval command? In the example below, I'm trying to create a value for "followup_live_agent" and "caller_silence" values. Splunk is telling me this query is invalid.

index=conversation sourcetype=cui-orchestration-log botId=123456 | eval AgentRequests=if(match(intent, "followup_live_agent" OR "caller_silence"), 1, 0)

Any help is much appreciated!

Re: Combing values in an eval match command

richgalloway — Thu, 15 Sep 2022 16:54:41 GMT

The match function does not accept boolean expressions - only expects strings and fields containing strings. Try breaking it into 2 match calls.

index=conversation sourcetype=cui-orchestration-log botId=123456 | eval AgentRequests=if(match(intent, "followup_live_agent") OR match(intent, "caller_silence"), 1, 0)

topic How do I combine two searches in an eval command? in Splunk Search

How do I combine two searches in an eval command?

Re: Combing values in an eval match command