Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Eval with multiple values
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have three event types:
eventtype="windows_login_failed"
eventtype="duo_login_failed"
eventtype="sremote_login_failed"
I am trying to run a search in which I rename the event types to a common name:
Windows = eventtype="windows_login_failed"
DUO = eventtype="duo_login_failed"
Sremote = eventtype="sremote_login_failed"
I run the following search, but I keep getting an error message stating, 'Error in 'eval' command: The expression is malformed. Expected ).'
eventtype="windows_login_failed" OR eventtype="duo_login_failed" OR eventtype="sremote_login_failed" [| inputlookup xxx_xxx ] OR [| inputlookup yyy_yyy] | eval Source = (eventtype == windows_login_failed, "Windows"), (eventtype == sremote_login_failed, "SRemote"), (eventtype == duo_login_failed, "DUO") | stats count by myuser,Source| sort -count
Any help would be greatly appreciated
Thx
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
you'll need to make a case statement. try this
...| eval Source = case(eventtype == "windows_login_failed", "Windows", eventtype == "sremote_login_failed", "SRemote", eventtype == "duo_login_failed", "DUO")| ...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why you don't use a tag (e.g. Login_failed) assigned to th Three eventypes?
Bye.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Excellent idea!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please check this one -
eval Source=case(eventtype==windows_login_failed, "Windows", eventtype==sremote_login_failed, "SRemote", eventtype==duo_login_failed, "DUO")
eventtype="windows_login_failed" OR eventtype="duo_login_failed" OR eventtype="sremote_login_failed" [| inputlookup xxx_xxx ] OR [| inputlookup yyy_yyy] | eval Source=case(eventtype==windows_login_failed, "Windows", eventtype==sremote_login_failed, "SRemote", eventtype==duo_login_failed, "DUO") | stats count by myuser,Source| sort -count
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thx - that worked great. Appreciate the reply.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
you'll need to make a case statement. try this
...| eval Source = case(eventtype == "windows_login_failed", "Windows", eventtype == "sremote_login_failed", "SRemote", eventtype == "duo_login_failed", "DUO")| ...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thx - that worked great. Appreciate the reply.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
SplunkTrust Application Period is Officially OPEN!
