Splunk Search

Eval check condition not working

Explorer

Hello, I have the splunk query below which has multiple sourcetype rows and if the row has x-correlation-id keywpord matching it needs to return Status x-correlation-id (or) return missing otherwise, there are couple of rows which has x-correlation-id in header and all rows are currently returning as "missing" , any ideas why the match is not working ?

environment=prod sourcetype=* "x-correlation-id" | fields sourcetype, Properties.Headers{} , Properties.CorrelationId, CorrelationId, Category | eval Status=if(match("Properties.Headers{}", "X-Correlation-id"),"x-correlation-id", "missing") | dedup sourcetype | table sourcetype,Status, Properties.CorrelationId, CorrelationId, Category | sort str(Properties.Headers{})

sourcetype status Properties.CorrelationId

o1 missing c1

o2 missing c2

o3 missing c3

o4 missing c4

o5 missing c5
o6 missing c6

o7 missing c7

08 missing c8

Tags (2)
0 Karma

SplunkTrust
SplunkTrust
environment=prod sourcetype=* "x-correlation-id" 
| fields sourcetype, Properties.Headers{} , Properties.CorrelationId, CorrelationId, Category 
| rename Properties.Headers{} as Properties_Headers , Properties.CorrelationId as Properties_CorrelationId
| stats latest(*) as * by sourcetype
| eval Status=if(match(Properties_Headers, "(?i)X-Correlation-id"),"x-correlation-id", "missing")
| sort str(Properties_Headers)
| table sourcetype, Status, Properties_CorrelationId, CorrelationId, Category 

match() use REGEX , this is case-sensitive.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!