Splunk Search

Eval with multiple values

jwalzerpitt
Influencer

I have three event types:

eventtype="windows_login_failed"
eventtype="duo_login_failed"
eventtype="sremote_login_failed"

I am trying to run a search in which I rename the event types to a common name:

Windows = eventtype="windows_login_failed"
DUO = eventtype="duo_login_failed"
Sremote = eventtype="sremote_login_failed"

I run the following search, but I keep getting an error message stating, 'Error in 'eval' command: The expression is malformed. Expected ).'

eventtype="windows_login_failed" OR eventtype="duo_login_failed" OR eventtype="sremote_login_failed" [| inputlookup xxx_xxx ] OR [| inputlookup yyy_yyy] | eval Source = (eventtype == windows_login_failed, "Windows"), (eventtype == sremote_login_failed, "SRemote"), (eventtype == duo_login_failed, "DUO") | stats count by myuser,Source| sort -count

Any help would be greatly appreciated

Thx

0 Karma
1 Solution

cmerriman
Super Champion

you'll need to make a case statement. try this

...| eval Source = case(eventtype == "windows_login_failed", "Windows", eventtype == "sremote_login_failed", "SRemote", eventtype == "duo_login_failed", "DUO")| ...

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Why you don't use a tag (e.g. Login_failed) assigned to th Three eventypes?
Bye.
Giuseppe

0 Karma

jwalzerpitt
Influencer

Excellent idea!

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Please check this one -
eval Source=case(eventtype==windows_login_failed, "Windows", eventtype==sremote_login_failed, "SRemote", eventtype==duo_login_failed, "DUO")

eventtype="windows_login_failed" OR eventtype="duo_login_failed" OR eventtype="sremote_login_failed" [| inputlookup xxx_xxx ] OR [| inputlookup yyy_yyy] | eval Source=case(eventtype==windows_login_failed, "Windows", eventtype==sremote_login_failed, "SRemote", eventtype==duo_login_failed, "DUO") | stats count by myuser,Source| sort -count
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

jwalzerpitt
Influencer

Thx - that worked great. Appreciate the reply.

cmerriman
Super Champion

you'll need to make a case statement. try this

...| eval Source = case(eventtype == "windows_login_failed", "Windows", eventtype == "sremote_login_failed", "SRemote", eventtype == "duo_login_failed", "DUO")| ...

jwalzerpitt
Influencer

Thx - that worked great. Appreciate the reply.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...