How to do something like if two of more of ( s1,s2,s3 ) in URL, and symbol count > 2 in url?

[bluewizard]

.... url = "abc-jjjj-j-xyz.exmaple.come"
|eval s1 = abc
|eval s2 = efg
|eval s3 = xyz
|eval symbol ="-"

how do i do something like if two of more of ( s1,s2,s3 ) in URL, and symbol count > 2 in url?

[yeahnah]

Hi @bluewizard 

Here is a run anywhere example showing a few different methods you could use...

|makeresults
| eval url="abc-jjjj-j-xyz.exmaple.come"
      ,s1=if(match(url, "abc"), "true", "false")  ``` regex ```
      ,s2=if(match(url, "efg"), "true", "false")
      ,s3=if(like(url, "%xyz%"), "true", "false") ``` more SQL like ```
      ,s4=if(searchmatch("url=*jjjj*"), "true", "false")  ``` probably the least efficient method depending on the base seach ```

Here's the latest Splunk docs on eval functions, too.

https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/CommonEvalFunctions#Alphabetical_...

Hope that helps

[bluewizard]

i have tried the sql like method

how do i do something like if two or more of ( s1,s2,s3 ) in URL, and count of symbol > 2 in url?

[yeahnah · Accepted solution]

Hi @bluewizard 

Something like this would work.  

|makeresults
| eval url="abc-jjjj-j-xyz.exmaple.come"
      ,s1=if(match(url, "abc"), 1, 0)  ``` regex ```
      ,s2=if(match(url, "efg"), 1, 0)
      ,s3=if(like(url, "%xyz%"), 1, 0) ``` more SQL like ```
      ,s4=if(searchmatch("url=*jjjj*"), 1, 0)  ``` probably the least efficient method depending on the base seach ```
| addtotals label=s* fieldname="symbol_count"
| where symbol_count>2

 As the original question has been answered you should make this answer as solution provided.

Karma would also be appreciated too.

Hope that helps