Splunk Search

How do I use an eval command with a case function with regex to separate the blank vs any character?

Chandras11
Communicator

hi,

I have a field PORT_DESC with the values as:
"somethings sdsa Device:XYZ PORT: 1.2.3 BackPort: 4.5.6 some other text"
"somethings Othertext Device: PORT: BackPort: some other text"
Now I need to define a Port_Flag separating these values as:

eval Port_Flag= case(like(PORT_DESC,"%PORT:  BackPort:%"), "Flag_NO",like(PORT_DESC,"%PORT: 1.2.3 BackPort:%"),"Flag_YES",1=1,"Other")

However, the Port value can be anything such as 1.2.3 or CRMT or vw3d.

How can I separate these values where either no Port value is given or some value is assigned? Any regular expression will also be a great help, which can define

PORT:[Anything 0-9 or A-Z or a-z $%&/()]  BackPort:

Thanks in advance.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Instead of using like in your case statement, use match. The match function accepts regular expressions. For example,

eval Port_Flag= case(match(PORT_DESC,"PORT: BackPort:.*"), "Flag_NO", match(PORT_DESC,"PORT: .*? BackPort:.*"), "Flag_YES",1=1,"Other")

---
If this reply helps you, Karma would be appreciated.

Chandras11
Communicator

Thanks for the info. However, .*? take everything. How can I remove not 1 but any number fo space characters there?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

.*? is non-greedy and should stop at " BackPort". \S+ is an alterative (perhaps a better one).

---
If this reply helps you, Karma would be appreciated.
0 Karma

whrg
Motivator

Try: PORT: [^ ]+ BackPort:

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...