Splunk Search
Highlighted

How to edit my eval statement to produce results from 1 of 2 source types, not both?

Path Finder

I have made an inquiry on having a subsearch that will allow the user to:
1) within one index, search two different sourcetypes for an item (url and/or host)
2) if the item is found in sourcetype(A) then sourcetype(B) is ignored
3) if the item is found in sourcetype(B) then sourcetype(A) is ignored
4) produce the search result
5) sourcetype (A) is the primary (B) is the secondary

the search string below works but produces search results from both sourcetypes

index=*   sourcetype=(A)  OR sourcetype=(B) | eval search=case(sourcetype == (A), "true", sourcetype == (A), "false" , 1=1, "true") 
| search "url=" OR "dest_nt_host=*" | eval search=if(isnull(url),elsefield,dest_nt_host)
0 Karma
Highlighted

Re: How to edit my eval statement to produce results from 1 of 2 source types, not both?

Super Champion

if you changed your eval to this:

| eval search=if(sourcetype == (A), "true",  "false" ) 

does it evaluate correctly?

0 Karma
Highlighted

Re: How to edit my eval statement to produce results from 1 of 2 source types, not both?

Path Finder

the result is the same either way

0 Karma
Highlighted

Re: How to edit my eval statement to produce results from 1 of 2 source types, not both?

Legend

Do the two sourcetypes have any common fields to match them on?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.