topic Re: How can I include a wildcard character in eval command? in Splunk Search

How can I include a wildcard character in eval command?

tamduong16 — Tue, 29 Sep 2020 15:30:16 GMT

I have the following search:

eval "tt"=case(transporttype="sip","Sip",................)

I can't figure out how do i include wildcard character behind and infront of sip. I have the following information in my data:
video sip
video_sip
sip_audio

I just want to count everything that has the word "sip" in there. How could i do this is eval command?

Re: How can I include a wildcard character in eval command?

DalJeanis — Thu, 24 Aug 2017 21:33:48 GMT

You are looking for the match() function or the like() function.

https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/ConditionalFunctions

match() uses regular expressions, like() uses a SQL-like syntax

| eval "tt"=case(match(transporttype,"(?i)sip"),"Sip",        ................)
| eval "tt"=case(like(transporttype,"%sip%"),"Sip",        ................)

updated to close both function parens as per @jkat54's suggestion, and make match expression case-insensitive and unanchored as per @woodcock's suggestion.

I make mistakes at least once a day, just to keep in practice.

Re: How can I include a wildcard character in eval command?

jkat54 — Thu, 24 Aug 2017 22:56:58 GMT

Close those match perenthisis @daljeanis

Re: How can I include a wildcard character in eval command?

woodcock — Fri, 25 Aug 2017 02:05:52 GMT

Splunk RegEx is always unanchored by default so this is better (and case insensitive):

| eval tt=case(match(transporttype, "(?i)sip"), "Sip", ........, true(), "OOPS!")

Re: How can I include a wildcard character in eval command?

jkat54 — Fri, 25 Aug 2017 16:11:33 GMT

"I make mistakes at least once a day, just to keep in practice"

Ha ha!

Re: How can I include a wildcard character in eval command?

woodcock — Fri, 25 Aug 2017 17:32:55 GMT

Some people think that I am really clever but actually I am EXTENSIVELY Ex-dumb. They look the same from the outside, if you ignore the scars.

Re: How can I include a wildcard character in eval command?

DalJeanis — Fri, 25 Aug 2017 22:22:52 GMT

@woodcock- yes, experience is a wonderful thing, isn't it? It enables you to quickly recognize a mistake when you make it again.