topic Why is statement not returning expected results when counting events by "UserAgent" field? in Splunk Search

Why is statement not returning expected results when counting events by "UserAgent" field?

SplunkySplunk — Fri, 29 Sep 2023 15:50:07 GMT

Hello
I'm trying to count events by field called "UserAgent"
If im searching for the events without any calculated field im getting results from different UserAgents
But once im using eval, I don't get the expected results
For example:
I've tried this eval and im getting only "android" also im searching for "ios" only with

"ContextData.UserAgent"=*ios*

as part of my query

| eval UserAgent = if("ContextData.UserAgent"="*ios*","ios","android")

what im doing wrong ?

Re: if statement not returning expected results

gcusello — Fri, 29 Sep 2023 14:11:04 GMT

Hi @SplunkySplunk,

the issue is that sometimes, having special chars (as dot) in the field names the eval command fails, use rename and it will work:

| rename ContextData.UserAgent AS ContextData_UserAgent | eval UserAgent = if("ContextData_UserAgent"="*ios*","ios","android")

Ciao.

Giuseppe

Re: if statement not returning expected results

ITWhisperer — Fri, 29 Sep 2023 14:29:34 GMT

A couple of things wrong - field names should be in single quotes not double quotes when on the right hand side of the evaluation - equalities don't work with *, that's just for search filters, try match()

| eval UserAgent = if(match('ContextData.UserAgent',"ios"),"ios","android")

Re: if statement not returning expected results

sarit_s — Sat, 30 Sep 2023 12:07:51 GMT

Thanks !