Splunk Search

Conditional searching using eval command with if match

mdeterville
Path Finder

Hi SMEs:

I would like to define a print event type to differentiate Remote Prints from Office Print jobs.

From my print logs, i'd like to:

Define channel = "Remote Print", where printer name contains "WING*RCA" else, "Office Print".

I started off with:
| eval channel = if(match(like printer="WING*RCA", "Remote Print"), "Office Print")

I'm still relatively new to these commands and would appreciate any assistance.

Thanks in advance,
Mac

Tags (1)
0 Karma

manjunathmeti
Champion

You can use both like and match functions with eval command to

  1. like(FIELD, PATTERN)
    This function returns TRUE if FIELD values matches the PATTERN.
    In PATTERN, you can use use the percent ( % ) symbol as a wildcard for multiple characters and use the underscore ( _ ) character for a single character match.

  2. match(FIELD, "REGEX")
    This is is regex based function and returns TRUE or FALSE based on whether REGEX matches FIELD values.

So both queries below returns same results:

| makeresults | eval printer ="Canon MF4770n (from WING_000.0.000.0-RCA)" | eval channel = if(match(printer, "WING.*RCA"), "Remote Print", "Office Print")

.

| makeresults | eval printer ="Canon MF4770n (from WING_000.0.000.0-RCA)" | eval channel = if(like(printer, "%WING%RCA%"), "Remote Print", "Office Print")
0 Karma

anmolpatel
Builder

If the name is WING[digit]RCA you can go with

| makeresults 
| eval raw = "Printer1%WING1RCA%;Printer2%WING2RCA;Printer3%WING;Printer4%RCA" 
| makemv raw delim=";" 
| mvexpand raw 
| rex field=raw "(?P<Printer>[^\%]+)%(?P<Location>[^\%]+)" 
| eval channel = if(match(Location, "WING\dRCA"), "Remote Office", "Office")
| table Printer Location channel

If there is more text in between, WING[text]RCA, you can break it down to

| eval channel = if(match(Location, "WING.*"), if(match(Location, ".*RCA"), "Remote Office", "Office"), "Office")
0 Karma

mdeterville
Path Finder

Thanks anmol.

The printer name typically looks like eg. Canon MF4770n (from WING_000.0.000.0-RCA).

0 Karma

anmolpatel
Builder

If the printer is an extracted key, the solution i've provided above will solve your query. Just change the variables as required.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...