topic Re: How to edit my eval case statement to exclude certain text from a field's value? in Splunk Search

How to edit my eval case statement to exclude certain text from a field's value?

nivethainspire_ — Mon, 07 Nov 2016 11:17:14 GMT

My field has following value

summary="java running in chrome"

I need a search such that summary should have the word "java" and shouldn't have "chrome", "firefox".

My search is :

|eval Application = case(Summary like "%Java%"  NOT "%chrome%" NOT "%firefox%","Java",Summary like "%flash%","flash")

but it is not working. Can anyone guide me?

Re: How to edit my eval case statement to exclude certain text from a field's value?

niketn — Mon, 07 Nov 2016 12:35:27 GMT

NOT keyword in not supported for case statement, so use ! instead for performing not expression.

|eval Application = case(Summary like "%Java%" AND ! ( Summary like "%chrome%" OR Summary like "%firefox%"),"Java",Summary like "%flash%","flash")

Re: How to edit my eval case statement to exclude certain text from a field's value?

nivethainspire_ — Mon, 07 Nov 2016 13:24:47 GMT

not working 😞
getting the following error.
Typechecking failed. 'OR' only takes boolean arguments.

Re: How to edit my eval case statement to exclude certain text from a field's value?

niketn — Mon, 07 Nov 2016 14:48:11 GMT

I have edited my answer as I was missing Summary like conditions in the not condition. Can you please retry the above and confirm?

Re: How to edit my eval case statement to exclude certain text from a field's value?

somesoni2 — Mon, 07 Nov 2016 15:35:54 GMT

Try something like this

your current search
|eval Application = case(match(Summary,"Java") AND NOT (match(Summary,"chrome") OR match(Summary,"firefox")), "Java" ,match(Summary,"flash"),"flash", true(),"other")