topic Re: How to build a search using 4 different ad hoc searches in Splunk Search

How to build a search using 4 different ad hoc searches

svemurilv — Tue, 29 Sep 2020 15:37:52 GMT

base-search earliest=-1h@m|
Desk
cli_attr="MOBILE_IND=N"

Mobile
cli_attr="MOBILE_IND=Y"

Emarketing
cli_attr="MOBILE_IND=Y" OR cli_attr="MOBILE_IND=N" PartnerCode=*

Non-Emarketing
cli_attr="MOBILE_IND=Y" OR cli_attr="MOBILE_IND=N" NOT PartnerCode=*

using these am trying to build a base search

|eval deskdev=if(cli_attr=="MOBILE_IND=N","MOBILE_IND=N",NULL)
|eval mobiledev=if(cli_attr!="MOBILE_IND=N","MOBILE_IND=N",NULL)
|eval eMarketing=if((cli_attr=="MOBILE_IND=Y") OR (cli_attr!="MOBILE_IND==Y") AND (PartnerCode=="") , "MOBILE_IND=Y",NULL)
|eval NoneMarketing=if((cli_attr=="MOBILE_IND=Y") OR (cli_attr!="MOBILE_IND=Y") AND (PartnerCode!=""),"MOBILE_IND=Y",NULL)

search not able to match the values with original, how would it possible.

Re: How to build a search using 4 different ad hoc searches

s2_splunk — Thu, 07 Sep 2017 17:56:31 GMT

This should work. I recommend using null() instead of NULL, but that's not your issue.
Can you provide a sample event? Are you sure your field contents in the events are present and have the exact value you are looking for?

This run-anywhere search validates that your query is correct: | makeresults | eval cli_attr="MOBILE_IND=N" | eval deskdev=if(cli_attr=="MOBILE_IND=N","MOBILE_IND=N",null())

Re: How to build a search using 4 different ad hoc searches

svemurilv — Thu, 07 Sep 2017 18:23:15 GMT

Am good with the Desktop and Mobile , but am not sure how to write the |eval condition for Emarketing and NonEmarketing. where i struck

Re: How to build a search using 4 different ad hoc searches

s2_splunk — Thu, 07 Sep 2017 18:30:37 GMT

This part (cli_attr=="MOBILE_IND=Y") OR (cli_attr!="MOBILE_IND==Y") makes no sense (it's always true), you may as well leave it out and just use PatnerCode

Re: How to build a search using 4 different ad hoc searches

svemurilv — Tue, 29 Sep 2020 15:37:57 GMT

missing these ?

Emarketing
cli_attr="MOBILE_IND=Y" OR cli_attr="MOBILE_IND=N" PartnerCode=*

Non-Emarketing
cli_attr="MOBILE_IND=Y" OR cli_attr="MOBILE_IND=N" NOT PartnerCode=*

Re: How to build a search using 4 different ad hoc searches

s2_splunk — Tue, 29 Sep 2020 15:38:00 GMT

What values can cli_attr have other than MOBILE_IND=Y and MOBILE_IND=N?

Maybe we can help better if you verbally describe the conditions you want to test for and the resulting values for the eval'ed target field, as I am not clear on what you want your outcome to be.

Re: How to build a search using 4 different ad hoc searches

svemurilv — Thu, 07 Sep 2017 19:35:48 GMT

here in the the search we have included a PartnerCode=* and NOT PartnerCode=* there 2 are the differences between emarketing and nonemarketing we should include that part also in the same |eval If condition for each

Re: How to build a search using 4 different ad hoc searches

woodcock — Fri, 08 Sep 2017 04:56:55 GMT

Like this:

base-search earliest=-1h@m
| stats count(eval(searchmatch("cli_attr=\"MOBILE_IND=N\""))) AS deskdev
        count(eval(searchmatch("cli_attr=\"MOBILE_IND=Y\""))) AS mobiledev
        count(eval(searchmatch("cli_attr=\"MOBILE_IND=Y\" OR cli_attr=\"MOBILE_IND=N\" PartnerCode=\"*\""))) AS eMarketing
        count(eval(searchmatch("cli_attr=\"MOBILE_IND=Y\" OR cli_attr=\"MOBILE_IND=N\" NOT PartnerCode=\"*\""))) AS NoneMarketing

It is hilarious but probably won't fly for you to call Non-eMarketing by None Marketing, kind of like a psychologist using therpaist.com.