Splunk Search

Help with eval and wildcards

a212830
Champion

Hi,

I'm trying to use eval for hosts, and need to use wildcards. I tried the following, but it's not working. How does eval handle wildcards?

index=main sourcetype=sensor_info 
| eval IDSGROUP = case(match(host==az*, "Tuscon RIG", host==bos*, "Boston RIG", host==tx*, "DFW RIG", host==ca*, "LAX RIG"))
| timechart avg(pkt_drop_percent) by host
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @a212830,
try to use like instead match

index=main sourcetype=sensor_info 
| eval IDSGROUP = case(like(host,"az%"), "Tuscon RIG", like(host,"bos%"), "Boston RIG", like(host,"tx%"), "DFW RIG", like(host,"ca%"), "LAX RIG")
| timechart avg(pkt_drop_percent) by host

Bye.
Giuseppe

View solution in original post

twinspop
Influencer

First you need to have your pattern wrapped in quotes.

Two, you need to use match() properly.

Then you need to fix your regex.

You probably want something like case(match(host,”az.*”),”Tuscon”,match(host,”bos.*”),”Boston”) for a shortened example

gcusello
Esteemed Legend

Hi @a212830,
try to use like instead match

index=main sourcetype=sensor_info 
| eval IDSGROUP = case(like(host,"az%"), "Tuscon RIG", like(host,"bos%"), "Boston RIG", like(host,"tx%"), "DFW RIG", like(host,"ca%"), "LAX RIG")
| timechart avg(pkt_drop_percent) by host

Bye.
Giuseppe

a212830
Champion

Thanks! !!

0 Karma

gcusello
Esteemed Legend

You're welcome!
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...