- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How do I edit my "eval if match" syntax to evaluate complex combinations with precedence on the order of operation?
jclemons7
Path Finder
10-15-2015
11:52 AM
Hello all,
I have the following eval function which functions properly:
| eval my_count=if(match(lower(FieldName),"\\\filename.exe"),1,0)
But I want to evaluate a few things in the if statement and need them to have precedence on the order of operation. What I'd like to be able to say is if FieldName contains \filename.exe
OR (bob AND uncle) then 1, else 0, but for the life of me, I can't get the expected results.
Any help is greatly appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
10-15-2015
12:19 PM
Here's a run-anywhere example.
|metadata type=sources | head 1 | eval FieldName="filename.exe" | eval bob=1 | eval uncle=1 | eval my_count=if(match(lower(FieldName),"\\\filename.exe") OR (bob==1 AND uncle==1),1,0) | table FieldName bob uncle my_count
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
