How can I include a wildcard character in eval command?

[tamduong16]

I have the following search:

eval "tt"=case(transporttype="sip","Sip",................)

I can't figure out how do i include wildcard character behind and infront of sip. I have the following information in my data:
video sip
video_sip
sip_audio

I just want to count everything that has the word "sip" in there. How could i do this is eval command?

[DalJeanis · Accepted solution]

You are looking for the match() function or the like() function.

https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/ConditionalFunctions

match() uses regular expressions, like() uses a SQL-like syntax

| eval "tt"=case(match(transporttype,"(?i)sip"),"Sip",        ................)
| eval "tt"=case(like(transporttype,"%sip%"),"Sip",        ................)

---

updated to close both function parens as per @jkat54's suggestion, and make match expression case-insensitive and unanchored as per @woodcock's suggestion.

I make mistakes at least once a day, just to keep in practice.

[woodcock]

Splunk RegEx is always unanchored by default so this is better (and case insensitive):

| eval tt=case(match(transporttype, "(?i)sip"), "Sip", ........, true(), "OOPS!")

[jkat54]

"I make mistakes at least once a day, just to keep in practice"

Ha ha!

[woodcock]

Some people think that I am really clever but actually I am EXTENSIVELY Ex-dumb. They look the same from the outside, if you ignore the scars.

[DalJeanis]

@woodcock- yes, experience is a wonderful thing, isn't it? It enables you to quickly recognize a mistake when you make it again.

[jkat54]

Close those match perenthisis @daljeanis