Splunk Search
Highlighted

Eval Condition Search

Path Finder

Hi,

Am looking for conditional eval search for my results, could you please help me with correct query.

index=myindex source="access" api="sendverification?email=&op=passwordrecovery" OR api="reset-password.html" OR api="*updatepassword" responsecode=200 OR responsecode=400
| eval API=case(api LIKE "%op=passwordrecovery", "Request Password Reset", api LIKE "%reset-password.html", "Email Link", api LIKE "%updatepassword", "updatepassword")
| chart count by API

but api=updatepassword has responsecode 200(success) and 400(failure), i need to display api updatepassword, responsecode 200 as success and api updatepassword, response_code 400 as failure

as result i need display all four api account with count like

Date, API, Count
2020-04-22, Request Password Reset, 10
2020-04-22, Email Link, 5
2020-04-22, Success, 9
2020-04-22, Failure, 1

Thanks!
Pavan

0 Karma
Highlighted

Re: Eval Condition Search

Influencer

hi @kpavan,

Try this.

index=myindex source="access" api="sendverification?email=*&op=passwordrecovery" OR api="*reset-password.html" OR api="*updatepassword" response_code=200 OR response_code=400
| eval API=case(like(api, "%op=passwordrecovery"), "Request Password Reset", like(api, "%reset-password.html"), "Email Link", like(api, "%updatepassword"), if(response_code == 200, "Success", "Failure"))
| chart count by API

View solution in original post

0 Karma
Highlighted

Re: Eval Condition Search

Path Finder

Thank you much @manjunathmeti !

0 Karma