Splunk Search

How to edit my eval case statement to exclude certain text from a field's value?

nivethainspire_
Explorer

My field has following value

summary="java running in chrome"

I need a search such that summary should have the word "java" and shouldn't have "chrome", "firefox".

My search is :

|eval Application = case(Summary like "%Java%"  NOT "%chrome%" NOT "%firefox%","Java",Summary like "%flash%","flash")

but it is not working. Can anyone guide me?

0 Karma
1 Solution

niketn
Legend

NOT keyword in not supported for case statement, so use ! instead for performing not expression.

|eval Application = case(Summary like "%Java%" AND ! ( Summary like "%chrome%" OR Summary like "%firefox%"),"Java",Summary like "%flash%","flash")

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

somesoni2
Revered Legend

Try something like this

your current search
|eval Application = case(match(Summary,"Java") AND NOT (match(Summary,"chrome") OR match(Summary,"firefox")), "Java" ,match(Summary,"flash"),"flash", true(),"other")
0 Karma

niketn
Legend

NOT keyword in not supported for case statement, so use ! instead for performing not expression.

|eval Application = case(Summary like "%Java%" AND ! ( Summary like "%chrome%" OR Summary like "%firefox%"),"Java",Summary like "%flash%","flash")

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

nivethainspire_
Explorer

not working 😞
getting the following error.
Typechecking failed. 'OR' only takes boolean arguments.

0 Karma

niketn
Legend

I have edited my answer as I was missing Summary like conditions in the not condition. Can you please retry the above and confirm?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...