Splunk Search
Highlighted

Help with eval and wildcards

Champion

Hi,

I'm trying to use eval for hosts, and need to use wildcards. I tried the following, but it's not working. How does eval handle wildcards?

index=main sourcetype=sensor_info 
| eval IDSGROUP = case(match(host==az*, "Tuscon RIG", host==bos*, "Boston RIG", host==tx*, "DFW RIG", host==ca*, "LAX RIG"))
| timechart avg(pkt_drop_percent) by host
0 Karma
Highlighted

Re: Help with eval and wildcards

Legend

Hi @a212830,
try to use like instead match

index=main sourcetype=sensor_info 
| eval IDSGROUP = case(like(host,"az%"), "Tuscon RIG", like(host,"bos%"), "Boston RIG", like(host,"tx%"), "DFW RIG", like(host,"ca%"), "LAX RIG")
| timechart avg(pkt_drop_percent) by host

Bye.
Giuseppe

View solution in original post

Highlighted

Re: Help with eval and wildcards

Champion

Thanks! !!

0 Karma
Highlighted

Re: Help with eval and wildcards

Legend

You're welcome!
Bye.
Giuseppe

0 Karma
Highlighted

Re: Help with eval and wildcards

Influencer

First you need to have your pattern wrapped in quotes.

Two, you need to use match() properly.

Then you need to fix your regex.

You probably want something like case(match(host,”az.*”),”Tuscon”,match(host,”bos.*”),”Boston”) for a shortened example