Splunk Search

How to use 'OR' boolean in an eval expression?

drizzo
Path Finder

We're combining many types of searches into one tabled alert. We create our own variables with an eval statement and pass log variables into these. On certain versions of Windows these log variables have different names (message vs name). So we're wondering how to have an 'OR' statement depending on which name we're given. Thanks.

For example, we have tried the following:

.... | eval "Event Description"=Message, name | table ... "Event Description"
.... | eval ("Event Description"=Message) OR ("Event Description"=name) | table ... "Event Description"
.... | eval "Event Description"=(Message) OR (name) | table ... "Event Description"
.... | eval "Event Description"=Message OR name | table ... "Event Description"

None of these seem to work. They usually give us malform eval expression errors.

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust
| eval "Event Description"=coalesce(Message, name)

The above will use Message if present, otherwise it will use name if present, and if neither are present the field will be null. Make sure the capitalization matches your system fields exactly.

View solution in original post

DalJeanis
SplunkTrust
SplunkTrust
| eval "Event Description"=coalesce(Message, name)

The above will use Message if present, otherwise it will use name if present, and if neither are present the field will be null. Make sure the capitalization matches your system fields exactly.

ddrillic
Ultra Champion

Beautiful thing !!!

drizzo
Path Finder

This is more than what I was expecting. Thank you very much! Works very well.

ddrillic
Ultra Champion

Something in the spirit of - | eval your_value=if(message="Event Description" OR name="Event Description", "xxxx"," all others")

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...