topic Re: multiple eval string value if they are in a field in Splunk Search

How to do something like if two of more of ( s1,s2,s3 ) in URL, and symbol count > 2 in url?

bluewizard — Fri, 19 May 2023 12:18:32 GMT

.... url = "abc-jjjj-j-xyz.exmaple.come"
|eval s1 = abc
|eval s2 = efg
|eval s3 = xyz
|eval symbol ="-"

how do i do something like if two of more of ( s1,s2,s3 ) in URL, and symbol count > 2 in url?

Re: multiple eval string value if they are in a field

yeahnah — Fri, 19 May 2023 02:47:30 GMT

Hi @bluewizard

Here is a run anywhere example showing a few different methods you could use...

|makeresults | eval url="abc-jjjj-j-xyz.exmaple.come" ,s1=if(match(url, "abc"), "true", "false") ``` regex ``` ,s2=if(match(url, "efg"), "true", "false") ,s3=if(like(url, "%xyz%"), "true", "false") ``` more SQL like ``` ,s4=if(searchmatch("url=*jjjj*"), "true", "false") ``` probably the least efficient method depending on the base seach ```

Here's the latest Splunk docs on eval functions, too.

https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/CommonEvalFunctions#Alphabetical_list_of_functions

Hope that helps

Re: multiple eval string value if they are in a field

bluewizard — Fri, 19 May 2023 03:04:40 GMT

i have tried the sql like method

how do i do something like if two or more of ( s1,s2,s3 ) in URL, and count of symbol > 2 in url?

Re: multiple eval string value if they are in a field

yeahnah — Fri, 19 May 2023 03:16:59 GMT

Hi @bluewizard

Something like this would work.

|makeresults | eval url="abc-jjjj-j-xyz.exmaple.come" ,s1=if(match(url, "abc"), 1, 0) ``` regex ``` ,s2=if(match(url, "efg"), 1, 0) ,s3=if(like(url, "%xyz%"), 1, 0) ``` more SQL like ``` ,s4=if(searchmatch("url=*jjjj*"), 1, 0) ``` probably the least efficient method depending on the base seach ``` | addtotals label=s* fieldname="symbol_count" | where symbol_count>2

As the original question has been answered you should make this answer as solution provided.

Karma would also be appreciated too.

Hope that helps