Splunk Search

How to change a name within a field?

happysplunkyay
New Member

I have hundreds of .tmp files that begin with evb* and exist within the "File Name" field. All I want to do is change all of their names to EVB. I've tried match, eval, rename, banging my head against the wall, and staring at my screen wishing it to happen. I'm sure it's something simple, but i'm missing it.

eval file=case("File Name"="evbd*","EVB") 

Please help!

0 Karma

niketnilay
Legend

@happysplunkyay... Can you add some samples of filenames you have got? Do you have this filename as a field? if not you would need to provide a sample event. Also why you need to search for evbd and convert only EVB to upper case?

If your field containing file name is filename, then following should work:

<YourBaseSearch>  filename=CASE("evbd*")
| eval filename=replace(filename,"evb","EVB")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

puneethgowda
Communicator

Try replace commond!

0 Karma

adonio
SplunkTrust
SplunkTrust

try single commas, answer here:
https://answers.splunk.com/answers/54359/eval-function-on-a-column-that-has-spaces.html

eval file=case('File Name'="evbd*","EVB")

0 Karma

happysplunkyay
New Member

the single quotes is definitely something I had wrong. As somesoni2 below stated, it's the wildcard * that eval doesn't get along with...

thanks for your time.

0 Karma

somesoni2
Revered Legend

The eval command doesn't support the wildcards that you use in base search. Instead use comparison functions e.g. like or match, like this. Also, in right side of eval/where, the field name should be enclosed in single quotes. With double quotes they are treated as literal string, not field:
Updated

eval file=case(like('File Name',"evbd%"),"EVB",'File Name') 

or

eval file=case(match('File Name',"evbd"),"EVB",'File Name') 

Also added default value for file should be same as "File Name" if it doesn't match your condition.

0 Karma

happysplunkyay
New Member

eval file=case(match('File Name',"evb*","EVB",'File Name')) |table file
gives me the error "Error in 'eval' command: The arguments to the 'match' function are invalid."

eval file=case(like('File Name',"evb*","EVB",'File Name')) |table file
just straight up says "The search job has failed due to an error."

I don't understand why it has to be this way - WHY OH WHY!?!?!?! 🙂

Thanks for your time, sir.

0 Karma

somesoni2
Revered Legend

Silly me. Missed position of brackets. Try the updated answer now.

0 Karma

happysplunkyay
New Member

I would LOVE to say that did it, but the changing of the parenthetical position didn't do the trick. It seems like this would be so easy. Thanks again for your time.

|eval file=case(match('File Name',"evb*"),"EVB",'File Name') |table file
"Error in 'eval' command: The arguments to the 'case' function are invalid."

| eval file=case(like('File Name',"evb%"),"EVB",'File Name') |table file
"The search job has failed due to an error"

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!