Getting Data In

Eval

Khuzair81
Path Finder

c= US

Language = abcdENGLISH123qw

..... | rex fields=Language "\w{4}(?<myval>)\d{4}"

| eval ans=case(c="US",myval, true(), "NA" ) | table ans, myval, c

Result

ans = NA

myval = English

c = US

 

I want the ans = English

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Khuzair81 

Can you please try this?

YOUR_SEARCH
| rex field=Language "^[a-zA-z]{4}(?<myval>\w+)\d{3}" 
| eval ans=case(c="US",myval, true(), "NA" ) 
| table ans, myval, c

 

My Sample Search :

 

| makeresults 
| eval c="US",Language="abcdENGLISH123qw" 
| rex field=Language "^[a-zA-z]{4}(?<myval>\w+)\d{3}" 
| eval ans=case(c="US",myval, true(), "NA" ) 
| table ans, myval, c


 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...