Splunk Search

Eval Condition Search

kpavan
Path Finder

Hi,

Am looking for conditional eval search for my results, could you please help me with correct query.

index=myindex source="access" api="sendverification?email=*&op=passwordrecovery" OR api="*reset-password.html" OR api="*updatepassword" response_code=200 OR response_code=400
| eval API=case(api LIKE "%op=passwordrecovery", "Request Password Reset", api LIKE "%reset-password.html", "Email Link", api LIKE "%updatepassword", "updatepassword")
| chart count by API

but api=updatepassword has response_code 200(success) and 400(failure), i need to display api updatepassword, response_code 200 as success and api updatepassword, response_code 400 as failure

as result i need display all four api account with count like

Date, API, Count
2020-04-22, Request Password Reset, 10
2020-04-22, Email Link, 5
2020-04-22, Success, 9
2020-04-22, Failure, 1

Thanks!
Pavan

0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

hi @kpavan,

Try this.

index=myindex source="access" api="sendverification?email=*&op=passwordrecovery" OR api="*reset-password.html" OR api="*updatepassword" response_code=200 OR response_code=400
| eval API=case(like(api, "%op=passwordrecovery"), "Request Password Reset", like(api, "%reset-password.html"), "Email Link", like(api, "%updatepassword"), if(response_code == 200, "Success", "Failure"))
| chart count by API

View solution in original post

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

hi @kpavan,

Try this.

index=myindex source="access" api="sendverification?email=*&op=passwordrecovery" OR api="*reset-password.html" OR api="*updatepassword" response_code=200 OR response_code=400
| eval API=case(like(api, "%op=passwordrecovery"), "Request Password Reset", like(api, "%reset-password.html"), "Email Link", like(api, "%updatepassword"), if(response_code == 200, "Success", "Failure"))
| chart count by API
0 Karma

kpavan
Path Finder

Thank you much @manjunathmeti !

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...