topic Re: Eval and if commands return unexpected result in Splunk Search

Eval and if commands return unexpected result

ddrillic — Sun, 03 Apr 2016 21:14:45 GMT

The question relates to https://answers.splunk.com/answers/387510/alternatives-to-using-join-command.html

index=provider source="*part-m-00009*"

returns events that belong to a scoop file which contains a part-m-00009 string in its name.

(index=provider source="*part-m-00009*")
 | eval tin_provider=if(source="*part-m-00009*","XXXX","ccccc")

returns ccccc for the tin_provider field.

Does it make sense?

I'm also trying -

| eval tin_provider=if(source=="*part-m-00009*","XXXX","ccccc")

Meaning, double equal with the same results, which is also weird.

Re: Eval and if commands return unexpected result

mattymo — Sun, 03 Apr 2016 21:34:15 GMT

hmm i wonder if the quotes around the source in your eval if is causing it to literally look for source containing asterisk...will test and let you know...

Re: Eval and if commands return unexpected result

martin_mueller — Sun, 03 Apr 2016 21:47:50 GMT

The operator = has different meaning in the search command (wildcard matching) and the eval command (equality).

To get wildcard matching in eval, you can use match() with regular expressions, like() with SQL-style wildcards, or searchmatch() to get asterisk wildcards like in the search command. Check out http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/CommonEvalFunctions for more info.

Re: Eval and if commands return unexpected result

ddrillic — Mon, 04 Apr 2016 00:23:24 GMT

Beautiful thing !!! it works -

| eval tin_provider=if(like(source,"%part-m-00009%"),"XXXX","ccccc")