topic Re: eval if command with returned value = all from dropdown list in Splunk Search

eval if command with returned value = all from dropdown list

krusovice — Fri, 09 Mar 2018 06:41:59 GMT

Hello all,

I'm forming the eval query based on the value extracted from dropdown token.

| eval city=if((_raw LIKE "%$city$%"),"$city$","0" )

Issue here is that the dropdown is having All=* configured. If user chosen "All" from the dropdown list, the "city" token will be equal to 0, which is not correct.

How can I pass all the "city" value to the next query if All is selected?

Re: eval if command with returned value = all from dropdown list

493669 — Fri, 09 Mar 2018 06:46:38 GMT

why you wont try simply

 | eval city="$city$"

Re: eval if command with returned value = all from dropdown list

deepashri_123 — Fri, 09 Mar 2018 06:47:17 GMT

Hey krusovice,

Is your city field already extracted?
If yes, then rather than writing eval you can try something like this:

index=* | search city=$city$

In this case, if you select all, city will be selected as city=* and that should help!!

Let me know if this worked!!

Re: eval if command with returned value = all from dropdown list

mayurr98 — Fri, 09 Mar 2018 06:50:08 GMT

why do not you just try city="$city$" to pass the city value?

Re: eval if command with returned value = all from dropdown list

krusovice — Fri, 09 Mar 2018 06:56:46 GMT

hi @493669 and @deepashri,

Both solution not working. There is no "city=" to be matched in the log. the $city$ field is from dropdown list (e.g. All, London, Mancester....etc).

Solution provided by @493669 still returning as "*".

Re: eval if command with returned value = all from dropdown list

mayurr98 — Fri, 09 Mar 2018 06:58:55 GMT

how are you getting events from the dropdown list? is it coming from lookup? or you are extracting it at search time ?
it would be great if you share sample events and xml for your current dashboard.

Re: eval if command with returned value = all from dropdown list

493669 — Fri, 09 Mar 2018 07:07:29 GMT

In what scenario you are using $city$ token? if you could share what output you are expecting...

Re: eval if command with returned value = all from dropdown list

krusovice — Fri, 09 Mar 2018 07:11:13 GMT

No it is not working. city token is from dropdown list. There is no such field "city=" in the log. My simplified query as below:

index=* "Country: $clicked_country$ - CITY: $city$" 
| eval country=if((_raw LIKE "%$clicked_country$%"),"$clicked_country$","0")
| eval city=if((_raw LIKE "%$city$%"),"$city$","0")
| stats values(date_hour) as "Hour" by country city

Re: eval if command with returned value = all from dropdown list

krusovice — Fri, 09 Mar 2018 07:15:04 GMT

city token from dropdown list is extracted using regex to catch the "city" in the log.

Sample log:
Request_A - Country: GERMANY - City: BER

Re: eval if command with returned value = all from dropdown list

krusovice — Fri, 09 Mar 2018 07:17:16 GMT

Desired output in table format as explained in:

https://answers.splunk.com/answers/624710/formatting-output-in-table.html

Re: eval if command with returned value = all from dropdown list

mayurr98 — Fri, 09 Mar 2018 07:25:12 GMT

why do not you extract city and country to make your job easier I see from the events they are in standard format.

| rex field=_raw "Country\:\s(?<country>[^\s]+)\s\-\sCity\:\s(?<city>[^\s]+)" | search city="$city$"

and then use * as a wildcard for ALL.

From your current search query you need to substitute * for the main search and % for the eval statement.

let me know if this helps!

Re: eval if command with returned value = all from dropdown list

493669 — Fri, 09 Mar 2018 07:35:13 GMT

try this:

index=*|  rex field=_raw "Country\:\s(?<country>[^\s]+).*City\:\s(?<city>[^\s]+)"
| search city="$city$" AND country="$clicked_country$"
 | stats values(date_hour) as "Hour" by country city

Re: eval if command with returned value = all from dropdown list

krusovice — Mon, 12 Mar 2018 02:42:58 GMT

Yes it is working fine now after several tests. Thanks to @mayurr98 and @493669.