Splunk Search

Eval with multiple values

jwalzerpitt
Influencer

I have three event types:

eventtype="windows_login_failed"
eventtype="duo_login_failed"
eventtype="sremote_login_failed"

I am trying to run a search in which I rename the event types to a common name:

Windows = eventtype="windows_login_failed"
DUO = eventtype="duo_login_failed"
Sremote = eventtype="sremote_login_failed"

I run the following search, but I keep getting an error message stating, 'Error in 'eval' command: The expression is malformed. Expected ).'

eventtype="windows_login_failed" OR eventtype="duo_login_failed" OR eventtype="sremote_login_failed" [| inputlookup xxx_xxx ] OR [| inputlookup yyy_yyy] | eval Source = (eventtype == windows_login_failed, "Windows"), (eventtype == sremote_login_failed, "SRemote"), (eventtype == duo_login_failed, "DUO") | stats count by myuser,Source| sort -count

Any help would be greatly appreciated

Thx

0 Karma
1 Solution

cmerriman
Super Champion

you'll need to make a case statement. try this

...| eval Source = case(eventtype == "windows_login_failed", "Windows", eventtype == "sremote_login_failed", "SRemote", eventtype == "duo_login_failed", "DUO")| ...

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Why you don't use a tag (e.g. Login_failed) assigned to th Three eventypes?
Bye.
Giuseppe

0 Karma

jwalzerpitt
Influencer

Excellent idea!

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Please check this one -
eval Source=case(eventtype==windows_login_failed, "Windows", eventtype==sremote_login_failed, "SRemote", eventtype==duo_login_failed, "DUO")

eventtype="windows_login_failed" OR eventtype="duo_login_failed" OR eventtype="sremote_login_failed" [| inputlookup xxx_xxx ] OR [| inputlookup yyy_yyy] | eval Source=case(eventtype==windows_login_failed, "Windows", eventtype==sremote_login_failed, "SRemote", eventtype==duo_login_failed, "DUO") | stats count by myuser,Source| sort -count
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

jwalzerpitt
Influencer

Thx - that worked great. Appreciate the reply.

cmerriman
Super Champion

you'll need to make a case statement. try this

...| eval Source = case(eventtype == "windows_login_failed", "Windows", eventtype == "sremote_login_failed", "SRemote", eventtype == "duo_login_failed", "DUO")| ...

jwalzerpitt
Influencer

Thx - that worked great. Appreciate the reply.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...