Splunk Search

Eval Condition Search

kpavan
Path Finder

Hi,

Am looking for conditional eval search for my results, could you please help me with correct query.

index=myindex source="access" api="sendverification?email=*&op=passwordrecovery" OR api="*reset-password.html" OR api="*updatepassword" response_code=200 OR response_code=400
| eval API=case(api LIKE "%op=passwordrecovery", "Request Password Reset", api LIKE "%reset-password.html", "Email Link", api LIKE "%updatepassword", "updatepassword")
| chart count by API

but api=updatepassword has response_code 200(success) and 400(failure), i need to display api updatepassword, response_code 200 as success and api updatepassword, response_code 400 as failure

as result i need display all four api account with count like

Date, API, Count
2020-04-22, Request Password Reset, 10
2020-04-22, Email Link, 5
2020-04-22, Success, 9
2020-04-22, Failure, 1

Thanks!
Pavan

0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

hi @kpavan,

Try this.

index=myindex source="access" api="sendverification?email=*&op=passwordrecovery" OR api="*reset-password.html" OR api="*updatepassword" response_code=200 OR response_code=400
| eval API=case(like(api, "%op=passwordrecovery"), "Request Password Reset", like(api, "%reset-password.html"), "Email Link", like(api, "%updatepassword"), if(response_code == 200, "Success", "Failure"))
| chart count by API

View solution in original post

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

hi @kpavan,

Try this.

index=myindex source="access" api="sendverification?email=*&op=passwordrecovery" OR api="*reset-password.html" OR api="*updatepassword" response_code=200 OR response_code=400
| eval API=case(like(api, "%op=passwordrecovery"), "Request Password Reset", like(api, "%reset-password.html"), "Email Link", like(api, "%updatepassword"), if(response_code == 200, "Success", "Failure"))
| chart count by API
0 Karma

kpavan
Path Finder

Thank you much @manjunathmeti !

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...