Splunk Search

Help with eval and wildcards

a212830
Champion

Hi,

I'm trying to use eval for hosts, and need to use wildcards. I tried the following, but it's not working. How does eval handle wildcards?

index=main sourcetype=sensor_info 
| eval IDSGROUP = case(match(host==az*, "Tuscon RIG", host==bos*, "Boston RIG", host==tx*, "DFW RIG", host==ca*, "LAX RIG"))
| timechart avg(pkt_drop_percent) by host
0 Karma
1 Solution

gcusello
Legend

Hi @a212830,
try to use like instead match

index=main sourcetype=sensor_info 
| eval IDSGROUP = case(like(host,"az%"), "Tuscon RIG", like(host,"bos%"), "Boston RIG", like(host,"tx%"), "DFW RIG", like(host,"ca%"), "LAX RIG")
| timechart avg(pkt_drop_percent) by host

Bye.
Giuseppe

View solution in original post

twinspop
Influencer

First you need to have your pattern wrapped in quotes.

Two, you need to use match() properly.

Then you need to fix your regex.

You probably want something like case(match(host,”az.*”),”Tuscon”,match(host,”bos.*”),”Boston”) for a shortened example

gcusello
Legend

Hi @a212830,
try to use like instead match

index=main sourcetype=sensor_info 
| eval IDSGROUP = case(like(host,"az%"), "Tuscon RIG", like(host,"bos%"), "Boston RIG", like(host,"tx%"), "DFW RIG", like(host,"ca%"), "LAX RIG")
| timechart avg(pkt_drop_percent) by host

Bye.
Giuseppe

View solution in original post

a212830
Champion

Thanks! !!

0 Karma

gcusello
Legend

You're welcome!
Bye.
Giuseppe

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!