Splunk Search

Can I combine an if like eval with mvappend?

ebs
Communicator

Hi, if possible I would like to combine the two eval statements below so I can optimise it for my datamodel

| eval uri=if(like('metric.uri_path', "/as/%/resume/as/authorization"), "resume/as/authorization.ping", uri)
| eval url_path=mvappend(metric.uri_path, uri)

Labels (4)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

I posted in your other message

| eval uri_path=if(like(uri_path, "/as/%/resume/as/authorization"), mvappend("resume/as/authorization.ping", uri_path), uri_path)

You don't need to use the other field uri

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

I posted in your other message

| eval uri_path=if(like(uri_path, "/as/%/resume/as/authorization"), mvappend("resume/as/authorization.ping", uri_path), uri_path)

You don't need to use the other field uri

 

ebs
Communicator

Brilliant! Thank you

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...