topic Re: Conditional searching using eval command in Splunk Search

Conditional searching using eval command

karthik40us — Tue, 02 Feb 2016 14:24:14 GMT

All,

I have the search below which is using eval and IF statement. I only want one of the search conditions to execute every time this search is called using the $LOB$ variable. It appears the logic is correct and seems like other ppl have gotten this type of search to work, but the below does not work.

To simplify my question, here is the logic

| eval IF "(condition)",then, "Search1", else, "Search2"

Any help on why this may not work??

| eval (newLOB1=if(($LOB$ != "*"), 

"([search index=aws-ec2inventory | fields - _raw | table accountName, instanceId,PrivateIPAddress | dedup instanceId  | eval (newLOB=(replace("$LOB$","COF-","")) |where accountName=newLOB | stats count])"),

"([search index=aws-ec2inventory | fields - _raw | table accountName, instanceId,PrivateIPAddress | dedup instanceId | search accountName=* | stats count])"))

Re: Conditional searching using eval command

javiergn — Tue, 02 Feb 2016 14:36:16 GMT

Hi, your query is a bit confusing.
Can you review and edit your question but using the Code Sample button (select your code then press the button with 1s and 0s) for your query in order to make sure no especial characters are omitted?

Thanks,
J

Re: Conditional searching using eval command

karthik40us — Tue, 02 Feb 2016 14:42:33 GMT

thanks..just reposted

Re: Conditional searching using eval command

javiergn — Tue, 02 Feb 2016 15:00:07 GMT

Hi, I'm afraid that's not the way conditionals work in Splunk.

This is what I would do instead:

index=aws-ec2inventory 
| fields accountName, instanceId, PrivateIPAddress, "$LOB$"
| dedup instanceId 
| eval newLOB = if("$LOB$" != "*", replace("$LOB$", "COF-", ""),"%")
| where accountName=newLOB 
| stats count

In principle that's the equivalent of your query but I'm still not sure about the following:

newLOB1=if(($LOB$ != "*")

What are you trying to achieve there? Is $LOB$ a token in your dashboard?

Hope that helps,
J

Re: Conditional searching using eval command

karthik40us — Tue, 02 Feb 2016 15:52:42 GMT

Thanks for the response !!.. you query worked only in cases where LOB !=" **" . If the variable LOB had * the results are 0. Any thoughts?. The below came back with 0 results

index=aws-ec2inventory 
 | fields accountName, instanceId, PrivateIPAddress, "*"
 | dedup instanceId 
 | eval newLOB = if("*" != "*", replace("*", "COF-", ""),"%")
 | where accountName=newLOB 
 | stats count

Re: Conditional searching using eval command

karthik40us — Tue, 02 Feb 2016 15:54:42 GMT

it almost feels like IF statement does not like "star" **

Re: Conditional searching using eval command

karthik40us — Tue, 02 Feb 2016 16:10:10 GMT

Also it worked for "**" if i removed the below line from the code

| where accountName=newLOB

Re: Conditional searching using eval command

javiergn — Tue, 02 Feb 2016 16:31:34 GMT

Hi, I'm now even more confused about what you are trying to do with the LOB variable. * is a wildcard that matches any character but it won't work as that in a where, because it works like an SQL where and you have to use percentage (%) instead.

So, can you give me an example with two simple tables about what you are trying to achieve so that I can understand a bit better?

This line here is killing my eyes 😄

| eval newLOB = if("*" != "*", replace("*", "COF-", ""),"%")

Re: Conditional searching using eval command

javiergn — Tue, 02 Feb 2016 16:33:12 GMT

By the way, if you just want to check whether a field is null or not you can use the isnull or isnotnull functions as part of your eval.

Re: Conditional searching using eval command

karthik40us — Tue, 02 Feb 2016 17:17:51 GMT

The goal is to do a count on $LOB$ (i.e account Name) within aws-ec2inventory index .

I am getting $LOB$(i.e account name) as dropdown box from a dashboard panel

If the $LOB$ is a ** (wildcard) then i need to provide a stats count on ALL

If the $LOB$ is not a ** then i am performing a replace function and providing a count for that particular account Name/$LOB$

table

LOB (dropdown input from dashboard)
All ----> (the value for this * )
COF-abcd-prod
COF-efgh-Dev
COF-njkd-Prod

Re: Conditional searching using eval command

karthik40us — Tue, 02 Feb 2016 22:09:29 GMT

Figured it out ..it was the where clause that was the issue and used LIKE instead...thanks for your help