Getting Data In

Eval

Khuzair81
Path Finder

c= US

Language = abcdENGLISH123qw

..... | rex fields=Language "\w{4}(?<myval>)\d{4}"

| eval ans=case(c="US",myval, true(), "NA" ) | table ans, myval, c

Result

ans = NA

myval = English

c = US

 

I want the ans = English

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Khuzair81 

Can you please try this?

YOUR_SEARCH
| rex field=Language "^[a-zA-z]{4}(?<myval>\w+)\d{3}" 
| eval ans=case(c="US",myval, true(), "NA" ) 
| table ans, myval, c

 

My Sample Search :

 

| makeresults 
| eval c="US",Language="abcdENGLISH123qw" 
| rex field=Language "^[a-zA-z]{4}(?<myval>\w+)\d{3}" 
| eval ans=case(c="US",myval, true(), "NA" ) 
| table ans, myval, c


 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...