Help with eval and wildcards

[a212830]

Hi,

I'm trying to use eval for hosts, and need to use wildcards. I tried the following, but it's not working. How does eval handle wildcards?

index=main sourcetype=sensor_info 
| eval IDSGROUP = case(match(host==az*, "Tuscon RIG", host==bos*, "Boston RIG", host==tx*, "DFW RIG", host==ca*, "LAX RIG"))
| timechart avg(pkt_drop_percent) by host

[twinspop]

First you need to have your pattern wrapped in quotes.

Two, you need to use match() properly.

Then you need to fix your regex.

You probably want something like case(match(host,”az.*”),”Tuscon”,match(host,”bos.*”),”Boston”) for a shortened example

[gcusello · Accepted solution]

Hi @a212830,
try to use like instead match

index=main sourcetype=sensor_info 
| eval IDSGROUP = case(like(host,"az%"), "Tuscon RIG", like(host,"bos%"), "Boston RIG", like(host,"tx%"), "DFW RIG", like(host,"ca%"), "LAX RIG")
| timechart avg(pkt_drop_percent) by host

Bye.
Giuseppe

[a212830]

Thanks! !!

[gcusello]

You're welcome!
Bye.
Giuseppe