Splunk Search

Conditional searching using eval command with if match

Path Finder

Hi SMEs:

I would like to define a print event type to differentiate Remote Prints from Office Print jobs.

From my print logs, i'd like to:

Define channel = "Remote Print", where printer name contains "WING*RCA" else, "Office Print".

I started off with:
| eval channel = if(match(like printer="WING*RCA", "Remote Print"), "Office Print")

I'm still relatively new to these commands and would appreciate any assistance.

Thanks in advance,

Tags (1)
0 Karma


You can use both like and match functions with eval command to

  1. like(FIELD, PATTERN)
    This function returns TRUE if FIELD values matches the PATTERN.
    In PATTERN, you can use use the percent ( % ) symbol as a wildcard for multiple characters and use the underscore ( _ ) character for a single character match.

  2. match(FIELD, "REGEX")
    This is is regex based function and returns TRUE or FALSE based on whether REGEX matches FIELD values.

So both queries below returns same results:

| makeresults | eval printer ="Canon MF4770n (from WING_000.0.000.0-RCA)" | eval channel = if(match(printer, "WING.*RCA"), "Remote Print", "Office Print")


| makeresults | eval printer ="Canon MF4770n (from WING_000.0.000.0-RCA)" | eval channel = if(like(printer, "%WING%RCA%"), "Remote Print", "Office Print")
0 Karma


If the name is WING[digit]RCA you can go with

| makeresults 
| eval raw = "Printer1%WING1RCA%;Printer2%WING2RCA;Printer3%WING;Printer4%RCA" 
| makemv raw delim=";" 
| mvexpand raw 
| rex field=raw "(?P<Printer>[^\%]+)%(?P<Location>[^\%]+)" 
| eval channel = if(match(Location, "WING\dRCA"), "Remote Office", "Office")
| table Printer Location channel

If there is more text in between, WING[text]RCA, you can break it down to

| eval channel = if(match(Location, "WING.*"), if(match(Location, ".*RCA"), "Remote Office", "Office"), "Office")
0 Karma

Path Finder

Thanks anmol.

The printer name typically looks like eg. Canon MF4770n (from WING_000.0.000.0-RCA).

0 Karma


If the printer is an extracted key, the solution i've provided above will solve your query. Just change the variables as required.

0 Karma
Get Updates on the Splunk Community!

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...

Announcing Our Splunk MVPs

We are excited to announce the first cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...