Conditional searching using eval command with if match

[mdeterville]

Hi SMEs:

I would like to define a print event type to differentiate Remote Prints from Office Print jobs.

From my print logs, i'd like to:

Define channel = "Remote Print", where printer name contains "WING*RCA" else, "Office Print".

I started off with:
| eval channel = if(match(like printer="WING*RCA", "Remote Print"), "Office Print")

I'm still relatively new to these commands and would appreciate any assistance.

Thanks in advance,
Mac

[manjunathmeti]

You can use both like and match functions with eval command to

1. like(FIELD, PATTERN)
   This function returns TRUE if FIELD values matches the PATTERN.
   In PATTERN, you can use use the percent ( % ) symbol as a wildcard for multiple characters and use the underscore ( _ ) character for a single character match.

2. match(FIELD, "REGEX")
   This is is regex based function and returns TRUE or FALSE based on whether REGEX matches FIELD values.

So both queries below returns same results:

| makeresults | eval printer ="Canon MF4770n (from WING_000.0.000.0-RCA)" | eval channel = if(match(printer, "WING.*RCA"), "Remote Print", "Office Print")

.

| makeresults | eval printer ="Canon MF4770n (from WING_000.0.000.0-RCA)" | eval channel = if(like(printer, "%WING%RCA%"), "Remote Print", "Office Print")

[anmolpatel]

If the name is WING[digit]RCA you can go with

| makeresults 
| eval raw = "Printer1%WING1RCA%;Printer2%WING2RCA;Printer3%WING;Printer4%RCA" 
| makemv raw delim=";" 
| mvexpand raw 
| rex field=raw "(?P<Printer>[^\%]+)%(?P<Location>[^\%]+)" 
| eval channel = if(match(Location, "WING\dRCA"), "Remote Office", "Office")
| table Printer Location channel

If there is more text in between, WING[text]RCA, you can break it down to

| eval channel = if(match(Location, "WING.*"), if(match(Location, ".*RCA"), "Remote Office", "Office"), "Office")

[mdeterville]

Thanks anmol.

The printer name typically looks like eg. Canon MF4770n (from WING_000.0.000.0-RCA).

[anmolpatel]

If the printer is an extracted key, the solution i've provided above will solve your query. Just change the variables as required.