topic Re: Conditional search in Splunk Search

Conditional search: How to use negative search in case command ?

mxh7777 — Mon, 06 Feb 2023 17:57:52 GMT

Hi,

I got these datas

URI	TXT	Param
A	My text and others	param 1
A	My text and others	param 2
A	My text	param 3
A	My text	param 4
B	My text and others	param 2
B	My text	param 3
C	My text and others	param 1
C	My text	param4

I'd like to extract the datas according these rules :

- If URI = A, extract TXT that not contains "others"

- Else extract all

to obtain these results

URI	TXT	Param
A	My text	param 3
A	My text	param 4
B	My text and others	param 2
B	My text	param 3
C	My text and others	param 1
C	My text	param4

I don't know how to build my request.

I try to use "case" command like this but it return a logical error (Error in 'EvalCommand': The arguments to the 'like' function are invalid. ) :

...
|eval TXT=case(URI="A", NOT LIKE("%others%"), 1=1, "others")
...

How to use negative search in case command ?

Thanks

Re: Conditional search

richgalloway — Mon, 06 Feb 2023 16:46:27 GMT

The case function takes arguments in pairs. The first half of the pair must be a boolean expression and the second half must be non-boolean. It is this non-boolean value that is assigned to TXT.

The like function requires two aruments. The first is a field name and the second is a SQL pattern to compare the field value against. If the field value matches the pattern then the function returns true; otherwise, it returns false.

Perhaps you only need a where command to filter out the undesired events.

| where (URL!="A" OR (URL="A" AND NOT like(TXT, "%others%")))

Re: Conditional search

mxh7777 — Wed, 08 Feb 2023 09:56:17 GMT

Thanks

This better with "where"