https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-display-a-particular-string-if-a/m-p/208485#M60839 <P>@ ddrillic &amp; Renjith.nair , thanks alot for sharing your knowledge. Great support ! executed the query successfully . </P> Sat, 26 Dec 2015 03:23:52 GMT Rias 2015-12-26T03:23:52Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-display-a-particular-string-if-a/m-p/208481#M60835 <P>If <CODE>AVSResponse = x</CODE>, then I need to display "matched" in the dashboard report. Likewise, if I have more than 10 value to be matched. Kindly help how I can set up the ssearch. thanks</P> Thu, 24 Dec 2015 08:07:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-display-a-particular-string-if-a/m-p/208481#M60835 Rias 2015-12-24T08:07:50Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-display-a-particular-string-if-a/m-p/208482#M60836 <P>Have you tried <STRONG>if</STRONG> or <STRONG>case</STRONG> from <A href="http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/Commonevalfunctions">http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/Commonevalfunctions</A></P> <P>Eg:</P> <PRE><CODE>... | eval description=case(error == 404, "Not found", error == 500, "Internal Server Error", error == 200, "OK") </CODE></PRE> Thu, 24 Dec 2015 16:53:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-display-a-particular-string-if-a/m-p/208482#M60836 renjith_nair 2015-12-24T16:53:15Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-display-a-particular-string-if-a/m-p/208483#M60837 <P>Looks great. Just tried something like - <BR /> index=iiii | eval cat=case(host == "aaaa", "customer", host == "bbbb", "customer") and it works.</P> Thu, 24 Dec 2015 17:26:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-display-a-particular-string-if-a/m-p/208483#M60837 ddrillic 2015-12-24T17:26:58Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-display-a-particular-string-if-a/m-p/208484#M60838 <P>Be sure to accept renjith.nair's answer of it worked for you. That way people can see what to do.</P> Thu, 24 Dec 2015 20:57:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-display-a-particular-string-if-a/m-p/208484#M60838 jplumsdaine22 2015-12-24T20:57:04Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-display-a-particular-string-if-a/m-p/208485#M60839 <P>@ ddrillic &amp; Renjith.nair , thanks alot for sharing your knowledge. Great support ! executed the query successfully . </P> Sat, 26 Dec 2015 03:23:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-display-a-particular-string-if-a/m-p/208485#M60839 Rias 2015-12-26T03:23:52Z