Splunk Search

Match using OR statement

rlautman
Path Finder

In in my host field I have several different addresses, 4 of these addresses are from Location1 and the rest are from Location2. I have constructed the below query to look for the matching addresses within the host fields and assign Location1 to those that match. I can't seem to look for the addresses I want to find in one match statement and the results from the query below, although correct, are a bit messy. Is is possible to use an OR statement within a match or is there another way of going about this?

index=serverapps | eval Loc=if((match(host,"12.34.56.78*")),"Location1","Location2") | eval Loc1=if((match(host,"12.345.67.*")),"Location1","Location2") | stats count by host,Loc,Loc1

Tags (3)
0 Karma
1 Solution

reed_kelly
Contributor

Match uses PCRE, so you have to escape "." as 1\.2\.3\.4, and you can use the | character as an OR operation:

match(host, "1\.2\.3\.4|5\.6\.7\.8")

View solution in original post

reed_kelly
Contributor

Match uses PCRE, so you have to escape "." as 1\.2\.3\.4, and you can use the | character as an OR operation:

match(host, "1\.2\.3\.4|5\.6\.7\.8")

View solution in original post

rlautman
Path Finder

This has worked a treat, thanks

0 Karma

linu1988
Champion

why not use a lookup, that will be easy and will be reliable with more results coming in future. You can also use CASE for this as well.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!