topic Re: How to search and filter based on values matched in an eval case statement? in Splunk Search

How to search and filter based on values matched in an eval case statement?

splunker1981 — Tue, 21 Jun 2016 19:47:09 GMT

Hello all,

Trying to figure out how to search or filter based on the matches in my case statement. I guess also want to figure out if this is the correct way to approach this search.

searchHere |  eval status=case(ship=_pro, "processed", ship=_ma, "sent") | stats values(field1), values(field2), values(filed3), values(status) by fieldx

Now, I want to search the contents of the values() function for only those that contain both strings matched in my case statement. I can't focus on a count because there are many other variations that could potentially match and thus making the count >1. Something like "if the field status contains the values: processed AND sent" in any order show me those events.

Thanks for the help in advance.

Re: How to search and filter based on values matched in an eval case statement?

sundareshr — Tue, 21 Jun 2016 20:02:05 GMT

Try this

searchHere (ship="_pro" OR ship="_ma"|  eval status=case(ship=_pro, "processed", ship=_ma, "sent") | stats values(field1), values(field2), values(filed3), values(status) by fieldx

*OR*

searchHere |  eval status=case(ship=_pro, "processed", ship=_ma, "sent", 1=1, "other") | search status="processed" OR status="sent" | stats values(field1), values(field2), values(filed3), values(status) by fieldx

Re: How to search and filter based on values matched in an eval case statement?

splunker1981 — Tue, 21 Jun 2016 20:19:17 GMT

Thanks for the reply, but the second search will match on EITHER/OR value. I only want to show results where BOTH values exists. Same issue with the first search, gives me either/or one or the other value.

Re: How to search and filter based on values matched in an eval case statement?

sowings — Tue, 29 Sep 2020 09:59:02 GMT

When you use values(), the resultant field is multi-value. This means it can have several values simultaneously. Testing for "this and that" is as simple as "mv_field=<value1> mv_field=<value2>" (the AND in between is implied). It might benefit you to use an "AS ..." clause in the stats call to rename the field to something easier to manage.

Re: How to search and filter based on values matched in an eval case statement?

somesoni2 — Tue, 21 Jun 2016 20:57:20 GMT

This should do it

Updated (replaced mvfind with mvfilter)

 searchHere |  eval status=case(ship=_pro, "processed", ship=_ma, "sent") | stats values(field1), values(field2), values(filed3), values(status) as status by fieldx | where isnotnull(mvfilter(match(status,"processed"))) AND isnotnull(mvfilter(match(status,"sent")))

Re: How to search and filter based on values matched in an eval case statement?

splunker1981 — Wed, 22 Jun 2016 19:01:54 GMT

Thanks for the help. I ran the search above and get the following error:
Error in 'where' command: The arguments to the 'mvfind' function are invalid.

I don't see anything referencing mvfind(match in the docs. Is that just saying match for the value in fieldx? Did you mean to use mvfilter? I tried that and that seems to return just the values I'm searching for.

Re: How to search and filter based on values matched in an eval case statement?

somesoni2 — Wed, 22 Jun 2016 19:27:51 GMT

Oops..wrong function used. Try the updated answer.

Re: How to search and filter based on values matched in an eval case statement?

splunker1981 — Wed, 22 Jun 2016 21:31:13 GMT

thanks for the help, that did the trick!