Splunk Search

Can you help me use the eval command with a wildcard question?

linuxology
New Member

Is there a way to do a search for any version that begins with a 5* in an eval search?

eval sofver = if (softwareversion=="5*", "Compliant", "Non-Compliant") chart count over system by sofver

I can get it to work with a specific version, say 5.2.1.5, but I need to figure out how to do anything with a 5.x.x.x

0 Karma

linuxology
New Member

Would you be able to tell me how to do a NOT Match?

0 Karma

sdchakraborty
Contributor

Hi,

Can you try the below,

eval sofver = if (match(softwareversion,"5*"), "Compliant", "Non-Compliant") 

Sid

0 Karma

linuxology
New Member

Would you be able to tell me how to do a match NOT?

0 Karma

sdchakraborty
Contributor

Just add NOT before match function ☺️

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...