topic Re: eval wildcards in Splunk Search

eval wildcards

gnovak — Thu, 09 Aug 2012 21:25:19 GMT

I have a search that uses some wildcards:

sourcetype="EPPWEB" source="/opt/log/*/web_server/info.log" WAT 
| rex field=_raw "USER (?P<registrar>\[\d+-\w\w\]) downloading .*/(?<filename>.+?)$" 
| search filename=Invoice.pdf OR filename=Statement.pdf OR filename=text.txt OR filename=*-*.pdf OR filename=*-*_invoice.html NOT filename=*-*_*.pdf 
| eval Actual=case(filename="Statement.pdf","Billing Statement",
                   filename="Invoice.pdf","Billing Invoice",
                   filename="text.txt","Billing Text",
                   filename="*-*.pdf","Scorecard",
                   filename="*-*_invoice.html","Drilldown Invoice")

You'll notice at the end of my eval command I used wildcards for the filenames. However, when I run this search the 2 filenames I identified in the eval command that are using wildcards will NOT show up in the Actual field. They show up as events and I can clearly see a line from the logs containing these filenames, but they aren't being assigned the filename I specified in the eval command.

Does eval not like wildcards???

Re: eval wildcards

lguinn2 — Thu, 09 Aug 2012 22:04:51 GMT

No, eval does not like wildcards. And you should also be using == instead of = in your case statement. Try the match function to deal with wildcards explicitly - but remember that match uses regular expressions.

sourcetype="EPPWEB" source="/opt/log/*/web_server/info.log" WAT 
| rex field=_raw "USER (?P<registrar>\[\d+-\w\w\]) downloading .*/(?<filename>.+?)$" 
| search filename=Invoice.pdf OR filename=Statement.pdf OR filename=text.txt OR filename=*-*.pdf OR filename=*-*_invoice.html NOT filename=*-*_*.pdf 
| eval Actual=case(filename=="Statement.pdf","Billing Statement",
                   filename=="Invoice.pdf","Billing Invoice",
                   filename=="text.txt","Billing Text",
                   match(filename,".*-.*\.pdf$"),"Scorecard",
                   match(filename,".*-.*_invoice\.html$"),"Drilldown Invoice")

This may work. Please comment if it doesn't!

Re: eval wildcards

gnovak — Fri, 10 Aug 2012 15:21:44 GMT

It did work. Thank you very much!

Re: eval wildcards

psciegienny — Tue, 14 Jul 2015 20:14:20 GMT

Hi, sorry for downvote misclick. I look at it again and match function is very useful.

Re: eval wildcards

rfiscus — Thu, 22 Sep 2016 21:13:23 GMT

Worked for me as well, thank you!

Re: eval wildcards

smitra_splunk — Fri, 20 Oct 2017 04:45:11 GMT

worked!!
Thanks. 🙂