Splunk Search

Help in writing eval

New Member

I have a string like ABC:BOOT3RDSUNMONTH_MAINT2_sadasdczxc1and I want to put the jobs which have boot in their string to be come under the event field and be named as Failed alert reboot. Also there are various entities under the event filed.Can anyone help here

Tags (1)
0 Karma


Hey mayank101,

I have two solutions for you! Just replace "YOURFIELDHERE" with whatever the field name the string you're working with is in.

The first uses an eval statement to look through your field to find any part of the string that matches "boot". If it finds it, it will create a new value under the "NEWFIELD" that provides a log entry with the string "Failed Alert Reboot".

| eval NEWFIELD = if(lower(YOURFIELDHERE) LIKE "%boot%", "Failed Alert Reboot", null)

Alternitvely, you can use the "rex" command to search your data for the word boot. This will match any instance of "boot" it finds in the data, and returns "BOOT" as the field value for the newly created failed_alert_reboot field.

| rex field=YOURFIELDHERE "(?i)(?<failed_alert_reboot>boot)"

Let me know if these don't work for you or if you need help!

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...