Dashboards & Visualizations

fetch host

Path Finder

what is the error in the below query which i am using to populate in drop down list

index=aaa(source="/var/log/testd.log") |stats count by host
| eval env=case(match(host, "*10qe*"), "Test",
match(host, "*10qe*"), "QA",
match(host, "*10qe*"), "Prod" )


Labels (1)
0 Karma


Hi @Jasmine ,

as @marnall said a space is missing between the index value and the source condition.

I suppose that the erro is that the argument of the match function in the eval command is a regex, so you don't need to use asterisk:

index=aaa (source="/var/log/testd.log") 
| stats count by host
| eval env=case(
   match(host, "10qe"), "Test",
   match(host, "10qe"), "QA",
   match(host, "10qe"), "Prod")



0 Karma


Some potential problems with your query are:

1. index=aaa(source="/var/log/testd.log")
Does not have a space between the index and source filters

2. the match() functions in your eval env=case() part should have valid regexes in the second argument of the match function, as in match(<field>,<regex>). Try this:
| eval env=case(match(host, ".*10qe.*"), "Test",
match(host, ".*10qe.*"), "QA",
match(host, ".*10qe.*"), "Prod" )

ref: https://docs.splunk.com/Documentation/SCS/current/SearchReference/ConditionalFunctions

0 Karma

Path Finder

host is same across all the env. i am facing issue when i bind the same value to drop down list saying "Duplicate values causing conflict". But i need dropdown list with TEST/QA/PROD(label) with same host value. - how can i achieve this?

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...