Splunk Search

How do I match based on multiple values using eval and like command

ezmo1982
Path Finder

Hi,

I have a field named operating_system. it can contain multiple values examples being "Windows 10", "Windows Server 2016", "Windows 7" and others.

I want to set a field named os_group based on the value of operating_system. So if the value operating_system value contains "Windows Server*" i want to set the os_group to "Server". If the value of operating_system is "Windows 7", "Windows 8", or "Windows 10", I want to set os_group to "Workstation"

I was trying to do it using seperate lines as below. But can i combine these into one eval function where i can specify multiple values to filter on? I will need to use wildcards.

| eval os_group=if(like(operating_system, "%Server%", "Server", os_group)
| eval os_group=if(like(operating_system, "%Windows 7%", "Workstation", os_group)

Thanks

Labels (1)
Tags (4)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @ezmo1982,

You can use case statement;

| eval os_group=case(like(operating_system, "%Server%", "Server",like(operating_system, "%Windows 7%", "Workstation", 1=1, os_group)
If this reply helps you an upvote and "Accept as Solution" is appreciated.

ezmo1982
Path Finder

Missing a ")" at the end of "%Server%" but apart from your spl does the job, thanks!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...