Splunk Search
Highlighted

How do you use the eval command when the field value contains multiple variables?

Path Finder

Hi,

How do I use the eval statement when the field value could contain multiple variables?

so for example my field "OS" could be;

Windows XP
Windows 7
Windows 10
Server 2003
Server2008

I want to use an eval to create two new fields; one for server OS and another for desktop OS

So something like

| eval server=if(OS="Server 2003" OR OS="Server2008")
| eval desktop=if(OS="Windows XP" OR OS="Windows 10")

Thanks.

0 Karma
Highlighted

Re: How do you use the eval command when the field value contains multiple variables?

Motivator

You could use either match or like as an eval function here ...

 | eval is_server = if(like(OS, "Server%"),"1","0")
 | eval is_desktop = if(like(OS, "Windows%"),"1","0")

Like uses a SQL-like wildcard matching. You can get even more flexibility with match - which uses regex...

 | eval is_server = if(match(OS, "Server\s?[\d]{4}"),"1","0")
 | eval is_desktop = if(like(OS, "Windows"),"1","0")

Hope this helps ...

0 Karma
Highlighted

Re: How do you use the eval command when the field value contains multiple variables?

SplunkTrust
SplunkTrust

Hi,

Try case

<yourBaseSearch>
| eval os_type=case(OS == "Windows XP" OR OS == "Windows 7" OR OS == "Windows 10", "desktop", OS == "Server 2003" OR OS == "Server2008", "server")

View solution in original post

0 Karma
Highlighted

Re: How do you use the eval command when the field value contains multiple variables?

Path Finder

worked like a charm. thanks.

0 Karma
Highlighted

Re: How do you use the eval command when the field value contains multiple variables?

SplunkTrust
SplunkTrust

Great, you are welcome

0 Karma