Help in writing eval

[mayank101]

I have a string like ABC:BOOT3RDSUNMONTH_MAINT2_sadasdczxc1and I want to put the jobs which have boot in their string to be come under the event field and be named as Failed alert reboot. Also there are various entities under the event filed.Can anyone help here

[rbechtold]

Hey mayank101,

I have two solutions for you! Just replace "YOURFIELDHERE" with whatever the field name the string you're working with is in.

The first uses an eval statement to look through your field to find any part of the string that matches "boot". If it finds it, it will create a new value under the "NEWFIELD" that provides a log entry with the string "Failed Alert Reboot".

| eval NEWFIELD = if(lower(YOURFIELDHERE) LIKE "%boot%", "Failed Alert Reboot", null)

Alternitvely, you can use the "rex" command to search your data for the word boot. This will match any instance of "boot" it finds in the data, and returns "BOOT" as the field value for the newly created failed_alert_reboot field.

| rex field=YOURFIELDHERE "(?i)(?<failed_alert_reboot>boot)"

Let me know if these don't work for you or if you need help!