Hi,
I am new to SPLUNK/SPL and I am wondering how can I check if the Tags field contains a tag "foo" within an eval.
Something like:
eval toto = if("tags{}" == "foo", 1,2)'
Thanks,
David
No, you can't simply use wildcards in field names. But you can try one of two approaches.
If you indeed have multiple tags.* fields parsed out, you can try combine them into a single string (or a multivalue field) using foreach and then search on that field. Ugly but should work.
Or you can use spath to extract the tags section into a separate field and then just use a regex match. Also ugly. 😉
Ahhhh... So it's not a tag in terms of "normal" splunk tags. It's just that you have a section of your json event called tags and it has some fields inside.
Does it parse properly? If so, you should probably have fields called tags.*.
So your problem is that you want to find a value among a set of fields.
I'm not sure you can use wildcards in fields specification.
No, you can't simply use wildcards in field names. But you can try one of two approaches.
If you indeed have multiple tags.* fields parsed out, you can try combine them into a single string (or a multivalue field) using foreach and then search on that field. Ugly but should work.
Or you can use spath to extract the tags section into a separate field and then just use a regex match. Also ugly. 😉
OK thank you very much.
I used spath:
| spath tags{} output=toto
| eval aa = if(mvfind(toto, "tag_searched")>0, "A", "B")
| eval mvfind(tag,"foo")
Thank you @PickleRick
I tried using mvfind but without any luck.
index = "phantom_container" earliest=-1d
| dedup id
| eval foo = if(isnull(mvfind(tags, "xyz")), «A» , «B»)
I guess I am not using the correct syntax to access the tags field.
I have the same issue with the field tenant_id.
What am I missing?
Thanks in advance,
David