Splunk Search

Help with eval and wildcards

Champion

Hi,

I'm trying to use eval for hosts, and need to use wildcards. I tried the following, but it's not working. How does eval handle wildcards?

index=main sourcetype=sensor_info 
| eval IDSGROUP = case(match(host==az*, "Tuscon RIG", host==bos*, "Boston RIG", host==tx*, "DFW RIG", host==ca*, "LAX RIG"))
| timechart avg(pkt_drop_percent) by host
0 Karma
1 Solution

Legend

Hi @a212830,
try to use like instead match

index=main sourcetype=sensor_info 
| eval IDSGROUP = case(like(host,"az%"), "Tuscon RIG", like(host,"bos%"), "Boston RIG", like(host,"tx%"), "DFW RIG", like(host,"ca%"), "LAX RIG")
| timechart avg(pkt_drop_percent) by host

Bye.
Giuseppe

View solution in original post

Influencer

First you need to have your pattern wrapped in quotes.

Two, you need to use match() properly.

Then you need to fix your regex.

You probably want something like case(match(host,”az.*”),”Tuscon”,match(host,”bos.*”),”Boston”) for a shortened example

Legend

Hi @a212830,
try to use like instead match

index=main sourcetype=sensor_info 
| eval IDSGROUP = case(like(host,"az%"), "Tuscon RIG", like(host,"bos%"), "Boston RIG", like(host,"tx%"), "DFW RIG", like(host,"ca%"), "LAX RIG")
| timechart avg(pkt_drop_percent) by host

Bye.
Giuseppe

View solution in original post

Champion

Thanks! !!

0 Karma

Legend

You're welcome!
Bye.
Giuseppe

0 Karma