topic Re: Why does this eval case not work? in Splunk Search

Why does this eval case not work?

jaycetan — Fri, 04 Nov 2022 18:27:35 GMT

The following is my ideal final query to be used in a dashboard.

index=cdn_app httpMessage.host=taxes* | eval _env=$env_host$ | eval _hostName=case(_env=="http:abc-h123-apps-prod","taxes.sf.com", _env=="http:abc-h123-apps-qa", "taxes-qa.sf.com") | search httpMessage.host=_hostName | spath output=status path=httpMessage.status | eval status=case(like(status, "2%"),"2xx",like(status, "4%"),"4xx",like(status, "5%"),"5xx") | stats count by status

It seems `_hostName` is not resolving even when I hardcode and values like so.

index=cdn_app httpMessage.host=taxes* | eval _env="taxes.sf.com" | eval _hostName=case(_env=="http:abc-h123-apps-prod","taxes.sf.com", _env=="http:abc-h123-apps-qa", "taxes-qa.sf.com") | search httpMessage.host=_hostName | stats count by httpMessage.host

I'm sure its with my eval case because this works just fine.

index=cdn_app httpMessage.host=taxes* | search httpMessage.host="taxes.sf.com" | stats count by httpMessage.host

Open to any suggestions. Thanks!

Re: Why does this eval case not work?

richgalloway — Fri, 04 Nov 2022 18:47:24 GMT

Avoid field names beginning with an underscore. They (with a few exceptions) are hidden by Splunk. Even most of the built-in underscored fields have to be copied to a regular field name before anything can be done with them - _index_time is a common example.

Re: Why does this eval case not work?

jaycetan — Fri, 04 Nov 2022 19:10:21 GMT

I initially had the values without the underscores. Unfortunately, removing them does not fix the issue. Appreciate the advice.

Re: Why does this eval case not work?

richgalloway — Fri, 04 Nov 2022 20:01:17 GMT

The case function is missing a default case so anything that doesn't match one of the two strings will be null. Null hosts will be ignored by the stats command.

index=cdn_app httpMessage.host=taxes* | eval env="taxes.sf.com" | eval hostName=case(env=="http:abc-h123-apps-prod","taxes.sf.com", env=="http:abc-h123-apps-qa", "taxes-qa.sf.com", 1==1, "???") | search httpMessage.host = hostName | stats count by httpMessage.host

Re: Why does this eval case not work?

ITWhisperer — Sat, 05 Nov 2022 07:07:03 GMT

Try with a where command

index=cdn_app httpMessage.host=taxes* | eval _env=$env_host$ | eval _hostName=case(_env=="http:abc-h123-apps-prod","taxes.sf.com", _env=="http:abc-h123-apps-qa", "taxes-qa.sf.com") | where httpMessage.host=_hostName | spath output=status path=httpMessage.status | eval status=case(like(status, "2%"),"2xx",like(status, "4%"),"4xx",like(status, "5%"),"5xx") | stats count by status