Splunk Search

Regex If Statement Help

jhayIV
Engager

This field is called 'Name' and contains around 10000 sever names, I am trying to use an eval formula to create a column to identify the vpvms of the following server name nadcvpvms04b.hca.corpad.net

I am a very new Splunk user I have tried everything and for the life of me can not get this to work and I am sure it is something easy.
This is what I have so far

The case statement I tried

| eval Physical Host Type=case(match(Name,"(?i)\p{Ll}vpvms"),"ESX Host")

and the if statement I tried

| eval Physical Host Type=if(match(Name,"(?i)\p{Ll}vpvms"),"ESX Host","")
Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

I don't understand exactly what you need but surely it is something like this:

| rex field=Name "(?i)pvms(?<Physical_Host_Type>\d+)"

View solution in original post

0 Karma

regexcracker
New Member

It will be better to give exact answer if you provide 1 or 2 lines of logs.

Thanks

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

I think it is easier then you think.

| eval Physical_Host_Type = case(match(Name,"(?i)vpvms"),"ESX Host",1==1,"None")

This is better for two reasons: Field names should NOT have spaces in them, it can be done, just not recommended. And the "1==1" is your always true statement, so you can filter out those that don't match later on. I have tested this on a different pattern, and it worked.

jhayIV
Engager

@alacercogitatus I tried your statement with no luck, I have provided a table of the data below. Those CI Names with vpvms I would like to have ESX show up in the Physical_Host_Type

CI Name Physical_Host_Type
ordcwpdbsaasc1b None
ordcvzvms01f None
ordcvpvms02c None
ordcvzvms01d None
nadcvpvms03a None

I appreciate the help

0 Karma

acharlieh
Influencer

Based on your table there, is your field actually called Name or is it actually 'CI Name' ?

0 Karma

jhayIV
Engager

@acharlieh Field Name is 'Name' Sorry about that

0 Karma

woodcock
Esteemed Legend

I don't understand exactly what you need but surely it is something like this:

| rex field=Name "(?i)pvms(?<Physical_Host_Type>\d+)"
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

That is not even a valid command. Please revise.

woodcock
Esteemed Legend

Sorry, skip the eval!

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...