use of eval statement in tokens evaluation

[PowerPacked]

Hi guys

Can you help me with this.

I have this extra search in the xml, just for evaluating tokens

am trying this, but its not working

<search>
    <query>|inputlookup abc.csv |search Field1="$token1$" Field2="$token2$" Field3="$token3$"</query>
    <earliest>-15m</earliest>
    <latest>now</latest>
          <done>
                     <eval token="token4">if('result.Field2' == *,"*","'result.Field4'")</eval>
           </done>
  </search>

the lookup file has Field1, Field2, Field3, Field4 values

when the above search runs with tokens passed - token1,token2,token3 -- it lists out values the specific Field4 value matching with Field3,Field2,Field1 Value

& the tokens token1, token2, token3 are coming from inputs in the same XML.

Requirement:

1)  if (Field2 or token2) AND (Field3 or token3) is  not *, need to set the token4 value as Field4 value
2) if Field2 or token2 is *, need to set the token4 value as *

Thanks

[woodcock]

If all that you need is to know the values of all of your tokens, then why not just use a tool that does that automatically for you? Try Developer Gadgets App for Splunk

https://splunkbase.splunk.com/app/3689/

[rvany]

Where do Field1, 2, ... come from. Where do the tokens come from? What's the content of abc.csv?

[PowerPacked]

fields are there in lookup file abc.csv
& the above tokens are coming from inputs in the XML.
lookup flle contain fields Field1,Field2,Field3,Field4

[rvany]

What happens if you set token4 to result.Field2 or ...3 regardless of their value, i.e. without using the if-construct.

[PowerPacked]

Thanks for reply

Yes the value of the Field2 is getting passed to token4, It was not working when i use eval if statement.

Thanks

[rey123]

Had the same use-case as PowerPacked. Commenting in case anyone was able to find a solution to this. Thanks