Splunk Search
Highlighted

How to search and filter based on values matched in an eval case statement?

Path Finder

Hello all,

Trying to figure out how to search or filter based on the matches in my case statement. I guess also want to figure out if this is the correct way to approach this search.

searchHere |  eval status=case(ship=_pro, "processed", ship=_ma, "sent") | stats values(field1), values(field2), values(filed3), values(status) by fieldx 

Now, I want to search the contents of the values() function for only those that contain both strings matched in my case statement. I can't focus on a count because there are many other variations that could potentially match and thus making the count >1. Something like "if the field status contains the values: processed AND sent" in any order show me those events.

Thanks for the help in advance.

0 Karma
Highlighted

Re: How to search and filter based on values matched in an eval case statement?

Legend

Try this

searchHere (ship="_pro" OR ship="_ma"|  eval status=case(ship=_pro, "processed", ship=_ma, "sent") | stats values(field1), values(field2), values(filed3), values(status) by fieldx 

*OR*

searchHere |  eval status=case(ship=_pro, "processed", ship=_ma, "sent", 1=1, "other") | search status="processed" OR status="sent" | stats values(field1), values(field2), values(filed3), values(status) by fieldx 
0 Karma
Highlighted

Re: How to search and filter based on values matched in an eval case statement?

Path Finder

Thanks for the reply, but the second search will match on EITHER/OR value. I only want to show results where BOTH values exists. Same issue with the first search, gives me either/or one or the other value.

0 Karma
Highlighted

Re: How to search and filter based on values matched in an eval case statement?

Splunk Employee
Splunk Employee

When you use values(), the resultant field is multi-value. This means it can have several values simultaneously. Testing for "this and that" is as simple as "mvfield=<value1> mvfield=<value2>" (the AND in between is implied). It might benefit you to use an "AS ..." clause in the stats call to rename the field to something easier to manage.

0 Karma
Highlighted

Re: How to search and filter based on values matched in an eval case statement?

SplunkTrust
SplunkTrust

This should do it

Updated (replaced mvfind with mvfilter)

 searchHere |  eval status=case(ship=_pro, "processed", ship=_ma, "sent") | stats values(field1), values(field2), values(filed3), values(status) as status by fieldx | where isnotnull(mvfilter(match(status,"processed"))) AND isnotnull(mvfilter(match(status,"sent")))

View solution in original post

0 Karma
Highlighted

Re: How to search and filter based on values matched in an eval case statement?

Path Finder

Thanks for the help. I ran the search above and get the following error:
Error in 'where' command: The arguments to the 'mvfind' function are invalid.

I don't see anything referencing mvfind(match in the docs. Is that just saying match for the value in fieldx? Did you mean to use mvfilter? I tried that and that seems to return just the values I'm searching for.

0 Karma
Highlighted

Re: How to search and filter based on values matched in an eval case statement?

SplunkTrust
SplunkTrust

Oops..wrong function used. Try the updated answer.

0 Karma
Highlighted

Re: How to search and filter based on values matched in an eval case statement?

Path Finder

thanks for the help, that did the trick!

0 Karma