Splunk Search

EVAL Command Help

Marco
Communicator

Hello Splunkers,

I am trying to write is a condition that says if command starts with "CHA" or "INS" add one.

The Query: 

host=*| eval AUDIT=if(like(COMMAND,"CHA % AUDIT%", "INS % AUDIT%"),1,0)| stats sum(AUDIT)

 

Not combining the conditions get me a working query EX: 

host=* | eval AUDIT=if(like(COMMAND,"CHA % AUDIT%"),1,0)|stats sum(AUDIT)

 

Is there a way I can get the query working?

 

 

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The solution is in the question.


I am trying to write is a condition that says if command starts with "CHA" or "INS" add one.

 

host=*
| eval AUDIT=if(like(COMMAND,"CHA % AUDIT%") OR like(COMMAND,"INS % AUDIT%"),1,0)
| stats sum(AUDIT)

 

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The solution is in the question.


I am trying to write is a condition that says if command starts with "CHA" or "INS" add one.

 

host=*
| eval AUDIT=if(like(COMMAND,"CHA % AUDIT%") OR like(COMMAND,"INS % AUDIT%"),1,0)
| stats sum(AUDIT)

 

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Marco
Communicator

Hi @richgalloway ,

After trying the query, I get and error message stating:

"Error in 'eval' command: The arguments to the 'like' function are invalid."

-Marco
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I've fixed my answer.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Marco
Communicator

Thank you so much,

I've been trying to figure that out for hours. 🙏

0 Karma