Splunk Search

How do you use the eval command when the field value contains multiple variables?

jacqu3sy
Path Finder

Hi,

How do I use the eval statement when the field value could contain multiple variables?

so for example my field "OS" could be;

Windows XP
Windows 7
Windows 10
Server 2003
Server2008

I want to use an eval to create two new fields; one for server OS and another for desktop OS

So something like

| eval server=if(OS="Server 2003" OR OS="Server2008")
| eval desktop=if(OS="Windows XP" OR OS="Windows 10")

Thanks.

0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi,

Try case

<yourBaseSearch>
| eval os_type=case(OS == "Windows XP" OR OS == "Windows 7" OR OS == "Windows 10", "desktop", OS == "Server 2003" OR OS == "Server2008", "server")

View solution in original post

0 Karma

harsmarvania57
Ultra Champion

Hi,

Try case

<yourBaseSearch>
| eval os_type=case(OS == "Windows XP" OR OS == "Windows 7" OR OS == "Windows 10", "desktop", OS == "Server 2003" OR OS == "Server2008", "server")
0 Karma

jacqu3sy
Path Finder

worked like a charm. thanks.

0 Karma

harsmarvania57
Ultra Champion

Great, you are welcome

0 Karma

DMohn
Motivator

You could use either match or like as an eval function here ...

 | eval is_server = if(like(OS, "Server%"),"1","0")
 | eval is_desktop = if(like(OS, "Windows%"),"1","0")

Like uses a SQL-like wildcard matching. You can get even more flexibility with match - which uses regex...

 | eval is_server = if(match(OS, "Server\s?[\d]{4}"),"1","0")
 | eval is_desktop = if(like(OS, "Windows"),"1","0")

Hope this helps ...

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...