topic Re: eval case not evaluating fields in Splunk Search

Why is eval case not evaluating fields?

lemospt — Thu, 20 Jul 2023 19:32:52 GMT

Hi,

i have a field with the models, like below, and with this info i want to define a new field like brand.

i tried different approaches but can't get brand field populated, below a test search with different case, none works but where clause works well.

index=core_ct_report_*
| where (report_model = "cfgHT802")
| eval brand=case(report_model=cfgHT802, grandstream)
| eval brand2=case(like(report_model, cfgHT802), grandstream)
| eval brand3=case(like(report_model, "cfg%"), grandstream)
| table report_model brand brand2 brand3

what is wrong?

What i need is something like this,

| eval brand3=case(like(report_model, "cfg%"), grandstream, ...)

Thanks,

Re: eval case not evaluating fields

yuanliu — Thu, 20 Jul 2023 11:47:02 GMT

First, note that screenshots are very unfavorable for volunteers. Please use text for illustration wherever possible.

Secondly, SPL interprets bare strings on the right-hand side (evaluation expressions) as field names. To match strings, you need to quote them properly.

index=core_ct_report_* | where (report_model = "cfgHT802") | eval brand=case(report_model=="cfgHT802", grandstream) | eval brand2=case(like(report_model, "cfgHT802"), grandstream) | eval brand3=case(like(report_model, "cfg%"), grandstream) | table report_model brand brand2 brand3

Re: eval case not evaluating fields

ITWhisperer — Thu, 20 Jul 2023 11:52:41 GMT

What is grandstream? If it is a field with content, then at least brand3 should have worked. If it is supposed to be a string, then it needs to be quoted (as do the other strings

| eval brand=case(report_model="cfgHT802", "grandstream") | eval brand2=case(like(report_model, "cfgHT802"), "grandstream") | eval brand3=case(like(report_model, "cfg%"), "grandstream")

Re: eval case not evaluating fields

lemospt — Thu, 20 Jul 2023 17:34:37 GMT

Thanks both for the inputs @ITWhisperer @yuanliu

the problem is the missing double quotes on the true condition like @ITWhisperer said.