topic Re: Regex If Statement Help in Splunk Search

Regex If Statement Help

jhayIV — Wed, 20 May 2015 21:04:24 GMT

This field is called 'Name' and contains around 10000 sever names, I am trying to use an eval formula to create a column to identify the vpvms of the following server name nadcvpvms04b.hca.corpad.net

I am a very new Splunk user I have tried everything and for the life of me can not get this to work and I am sure it is something easy.
This is what I have so far

The case statement I tried

| eval Physical Host Type=case(match(Name,"(?i)\p{Ll}vpvms"),"ESX Host")

and the if statement I tried

| eval Physical Host Type=if(match(Name,"(?i)\p{Ll}vpvms"),"ESX Host","")

Re: Regex If Statement Help

woodcock — Wed, 20 May 2015 21:10:11 GMT

I don't understand exactly what you need but surely it is something like this:

| rex field=Name "(?i)pvms(?<Physical_Host_Type>\d+)"

Re: Regex If Statement Help

alacercogitatus — Wed, 20 May 2015 21:17:27 GMT

I think it is easier then you think.

| eval Physical_Host_Type = case(match(Name,"(?i)vpvms"),"ESX Host",1==1,"None")

This is better for two reasons: Field names should NOT have spaces in them, it can be done, just not recommended. And the "1==1" is your always true statement, so you can filter out those that don't match later on. I have tested this on a different pattern, and it worked.

Re: Regex If Statement Help

alacercogitatus — Wed, 20 May 2015 21:18:13 GMT

That is not even a valid command. Please revise.

Re: Regex If Statement Help

woodcock — Wed, 20 May 2015 21:21:18 GMT

Sorry, skip the eval!

Re: Regex If Statement Help

regexcracker — Wed, 20 May 2015 21:52:42 GMT

It will be better to give exact answer if you provide 1 or 2 lines of logs.

Thanks

Re: Regex If Statement Help

jhayIV — Mon, 28 Sep 2020 19:59:58 GMT

@alacercogitatus I tried your statement with no luck, I have provided a table of the data below. Those CI Names with vpvms I would like to have ESX show up in the Physical_Host_Type

CI Name Physical_Host_Type
ordcwpdbsaasc1b None
ordcvzvms01f None
ordcvpvms02c None
ordcvzvms01d None
nadcvpvms03a None

I appreciate the help

Re: Regex If Statement Help

acharlieh — Thu, 21 May 2015 04:31:24 GMT

Based on your table there, is your field actually called Name or is it actually 'CI Name' ?

Re: Regex If Statement Help

jhayIV — Thu, 21 May 2015 18:59:35 GMT

@acharlieh Field Name is 'Name' Sorry about that