Splunk Search

Conditional Eval based on value in the field

New Member

I am trying to use transaction command to correlate two event types. I need to correlate events based on value in "id" part of the following searches.
Search 1:- event=A somefield=job_type-id
For Eg:- event=end somefield=job1-AAAAAAAAA
Search 2:- event=B job_type=id
For Eg:- event=start job1=AAAAAAAAA
Can contain multiple job_types in single event

Search 1 can contain 4 different types of "job_type", like, job1, job2, job3 and job4. Search 1 will only contain one "job_type" for any given event. Value of "id" is not extracted in any field.
Search 2 contains the above 4 types of jobs with corresponding "id". But, few Search 2 events can have multiple job_types. For Eg:- event=start job1=AAAAAAAAA job2=BBBBBBBB

I am using following transaction search,

(Search 1) OR (Search 2)
| rex somefield=(?>type>\w+\d)-(?>id>.*)
| eval newfield=if(len(id)>0,id,if(len(job1)>0,job1,if(len(job2)>0,job2,if(len(job3)>0,job3,if(job4)>0,job4,""))))
| transaction newfield keepevicted=true maxspan=1m
| where eventcount < 2
| table _raw type id

Above search works fine, but when Search 1 contains job3 as job_type and Search 2 contains job1 and job3. It does not correlates events. This is expected as in "eval" condition job1 is given preference.

I wanted to know if there is a way to reorder the "eval" condition based on job_type in Search 1, something like below (it does not works),

| eval a = if(len(id)>0,id,if(len(job1)>0,job1,if(len(job2)>0,job2,if(len(job3)>0,job3,if(job4)>0,job4,""))))
| eval b = if(len(id)>0,id,if(len(job2)>0,job2,if(len(job1)>0,job1,if(len(job3)>0,job3,if(job4)>0,job4,""))))
| eval c = if(len(id)>0,id,if(len(job3)>0,job3,if(len(job2)>0,job2,if(len(job1)>0,job1,if(job4)>0,job4,""))))
| eval d = if(len(id)>0,id,if(len(job4)>0,job4,if(len(job2)>0,job2,if(len(job3)>0,job3,if(job1)>0,job1,""))))
| eval newfield=case(
type=job1, a,
type=job2, b,
type=job3, c,

type=job4, d,
1 == 1, "NULL"

0 Karma


So, if I'm reading this correctly...

In event 2, which job do you want to match on?

Could you provide samples of the four possible styles of events for each of search 1 and search 2? Obviously, redact information that shouldn't get out, but also keep in mind we're data people - we can read data and also sometimes if you obfuscate too well we "lose sight of what it is you are doing". Also, most information isn't as secret as people think. 🙂

0 Karma

Ultra Champion

The case command can help here.

Something in the spirit of eval a = case (len(id) > 0,id, len(job1) > 0, job1, .......

0 Karma

New Member

I tried with case as well, but does not help.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...