Matching patterns in multiple varieties of field values

[mbasharat]

I have an index=os
It has a field name os_description.
This field has multiple versions/flavors of os mentioned in various varieties like samples below. I need everything that matches to be Windows 95 to display in additional column/field as Windows_95 for example. eval needs to be case insensitive and space insensitive e.g. something like "win*95" should match anything like below and output as Windows_95.

I tried using below and it gives desired results but gets very long because I have long list of other OSs and versions.

| eval OS_Grouped = case(
match(os_description,"WIN95"),"Windows_95",
match(os_description,"WIN 95"),"Windows_95",
match(os_description,"Win95"),"Windows_95",
match(os_description,"Win 95"),"Windows_95",
match(os_description,"WINDOWS 95"),"Windows_95",
match(os_description,"Windows 95"),"Windows_95",
match(os_description,"Unknown"),"Unknown",
true(),"Unknown")

Result columns to be: os_description, OS_Grouped

How to reduce above eval and match in most efficient manner and least performance impact on my Splunk infrastructure so SH and IDXers dont have to work hard for long list of evals and match functions. Thanks in-advance!!!

[arjunpkishore5]

Try this

| eval OS_Grouped=if(like(lower(type),"%win%95"), "Windows_95","Unknown")

[bowesmana · Accepted solution]

A simple regex for the above would be

| eval OS_Grouped=if(match(os_description, "(?i)win.*95"), "Windows_95", "Unknown")

it might catch some false positives, but you'd have to check your data. If you need more os variants in there, then it would probably require a case statement.

The alternative is to maintain a lookup of all the os_description variants and just do a lookup on the table. I'm not sure which would be more efficient, but you could look at the job details to find out.

[mbasharat]

Hi @ bowesmana,

Will your provided RegEx catch/match all the 7 variations above? so I can reduce all 7 match statement+ 1 true statement to just one RegEx.

[bowesmana]

Yes

See this

| makeresults 
| eval a="WIN95", b="WIN 95", c="Win95", d="Win 95", e="WINDOWS 95", f="Windows 95", g="Unknown", h="Random" 
| fields - _time 
| transpose 
| rename "row 1" as os_description 
| fields os_description 
| eval OS_Grouped=if(match(os_description, "(?i)win.*95"), "Windows_95", "Unknown") 
| table os_description, OS_Grouped

[arjunpkishore5]

Just realized that our answers are similar. Upvoting 🙂