topic Re: creating an 'other' field with eval in Splunk Search

creating an 'other' field with eval

tomlongfield — Fri, 22 Apr 2016 09:40:28 GMT

I am quite knew to this and not remotely wedded to eval as the solution for this problem, I am eager to know if there is a better way to do this.

I am currently using this query:

index=cpdata | eval ua = case(
    match(userAgent, "MSIE"), "Windows",
    match(userAgent, "Windows"), "Windows",
    match(userAgent, "Android"), "Android",
    match(userAgent, "BlackBerry"), "BlackBerry",
    match(userAgent, "like Mac OS X"), "iOS"
) | chart count by ua | sort by count | reverse

Which is successfully giving me what I expect to see.. I want to create a further case of 'Other' where anything that doesn't match is counted though. I have not managed to do this.

Re: creating an 'other' field with eval

Richfez — Fri, 22 Apr 2016 11:55:47 GMT

Try this - one always equals one so it'll always be true...

 index=cpdata | eval ua = case(
     match(userAgent, "MSIE"), "Windows",
     match(userAgent, "Windows"), "Windows",
     match(userAgent, "Android"), "Android",
     match(userAgent, "BlackBerry"), "BlackBerry",
     match(userAgent, "like Mac OS X"), "iOS",
     1==1, "Other"
 ) | chart count by ua | sort by count | reverse

Re: creating an 'other' field with eval

tomlongfield — Fri, 22 Apr 2016 12:00:09 GMT

Works perfectly, thank you.