Splunk Search

How do I match based on multiple values using eval and like command

ezmo1982
Path Finder

Hi,

I have a field named operating_system. it can contain multiple values examples being "Windows 10", "Windows Server 2016", "Windows 7" and others.

I want to set a field named os_group based on the value of operating_system. So if the value operating_system value contains "Windows Server*" i want to set the os_group to "Server". If the value of operating_system is "Windows 7", "Windows 8", or "Windows 10", I want to set os_group to "Workstation"

I was trying to do it using seperate lines as below. But can i combine these into one eval function where i can specify multiple values to filter on? I will need to use wildcards.

| eval os_group=if(like(operating_system, "%Server%", "Server", os_group)
| eval os_group=if(like(operating_system, "%Windows 7%", "Workstation", os_group)

Thanks

Labels (1)
Tags (4)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @ezmo1982,

You can use case statement;

| eval os_group=case(like(operating_system, "%Server%", "Server",like(operating_system, "%Windows 7%", "Workstation", 1=1, os_group)
If this reply helps you an upvote and "Accept as Solution" is appreciated.

ezmo1982
Path Finder

Missing a ")" at the end of "%Server%" but apart from your spl does the job, thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...