topic Re: Why is the eval if statement in my search not producing any results if I add anything more with the AND operation? in Splunk Search

Why is the eval if statement in my search not producing any results if I add anything more with the AND operation?

mgrosholz — Wed, 17 Aug 2016 17:54:02 GMT

I am doing a search on two sourcetypes and looking for data that matches multiple parts of a field called method.
The two sourcetypes and first eval/case function work properly.
The second function fails if I add any more to the if statement with the AND operation.<--fails as in does not show any data.
The last part works with the stats/path if I remove the if statement that is causing trouble.

sourcetype="A" OR sourcetype="B"
| eval HOST=case(sourcetype="A",host,sourcetype="B",host2)
| eval foo=if((method="X" AND method="Y" ...), "Suspect", null()) 
| stats values(foo) count(path) as PATH by HOST
| where PATH>=10

Re: Why is the eval if statement in my search not producing any results if I add anything more with the AND operation?

sundareshr — Wed, 17 Aug 2016 17:58:29 GMT

Since method is a single field, you should try OR instead of AND. The AND condition will not be true,

Re: Why is the eval if statement in my search not producing any results if I add anything more with the AND operation?

mgrosholz — Wed, 17 Aug 2016 18:01:27 GMT

The problem is I need that field to match on every part I AND.
i.e. method must equal X,Y,Z,... to trigger/pull results.

Re: Why is the eval if statement in my search not producing any results if I add anything more with the AND operation?

somesoni2 — Wed, 17 Aug 2016 18:05:06 GMT

The expression method="X" AND method="Y" will never be true as method can be either X or Y in same event.
If you're looking to match that field method contains X and Y, then try like this

sourcetype="A" OR sourcetype="B"
| eval HOST=case(sourcetype="A",host,sourcetype="B",host2)
| eval foo=if((match(method,"X") AND match(method,"Y")), "Suspect", null()) 
| stats values(foo) count(path) as PATH by HOST
| where PATH>=10

Re: Why is the eval if statement in my search not producing any results if I add anything more with the AND operation?

s2_splunk — Wed, 17 Aug 2016 18:05:42 GMT

The eval is executed per event, so on a single event, method can never be X AND Y at the same time...?

Re: Why is the eval if statement in my search not producing any results if I add anything more with the AND operation?

sundareshr — Wed, 17 Aug 2016 18:14:41 GMT

Is method extracted as a multi-value field? If yes, try this

... | eval foo=if(isnotnull(mvfind(method,"X")) AND isnotnull(mvfind(method,"Y"))...

Re: Why is the eval if statement in my search not producing any results if I add anything more with the AND operation?

mgrosholz — Wed, 17 Aug 2016 18:16:52 GMT

I understand the confusion. I am not looking for a single event, rather multiple events.

i.e. A large group of events that show results by HOST, and if that HOST has events in method as X and Y it displays the data.

Essentially, I am looking for a pattern and displaying results when that pattern is found.

Is this a clearer explanation?

Re: Why is the eval if statement in my search not producing any results if I add anything more with the AND operation?

sundareshr — Thu, 18 Aug 2016 02:49:03 GMT

See if this works for you

    sourcetype="A" OR sourcetype="B"
    | eval HOST=case(sourcetype="A",host,sourcetype="B",host2)
    | stats values(method) as method count(path) as PATH  by host
    | eval foo=if(mvfind(method,"X")>=0 AND mvfind(method,"Y")>=0, "found", "didnotfind")
    | where PATH>=10 
    | fields - method