Splunk Search

Search in eval if

Path Finder

I want to do something like

...base search | eval Mod=if(Module=Excel OR Module=Word, [search extension=xls OR extension=xslx OR extension=doc OR extension=docx|stats count by extension],"It is not an MS Office document")...

I always keep running into an error that says the search encountered an unexpected character. Please help.

Tags (2)
0 Karma

Motivator

Hi there, please try addin single quotes ' before and after the brackets, like this.

...base search | eval Mod=if(Module=Excel OR Module=Word, '[search extension=xls OR extension=xslx OR extension=doc OR extension=docx|stats count by extension]',"It is not an MS Office document")...

Hope it helps.

0 Karma

Path Finder

How will I get the output out of it? How will I get results of Mod?

0 Karma

New Member

where you able to solve this issue?

0 Karma

SplunkTrust
SplunkTrust

Try something like...

...base search 
| eval myExt=if(extension="xls" OR extension="xlsx" OR extension="doc" OR extension="docx",extension,"Not MS Office")
| stats count by myExt
0 Karma

Path Finder

That doesn't work for me. in the base search it's like if Module=$field2$. So if the module matches some value x, I want to search something and display a chart. Otherwise I want to search something else and display a different chart.

0 Karma

Builder

Can you explain what is the output you are expecting?

Mod is variable and the if condition if first case returns a table and not a single value, and in second case is set with a text message.

0 Karma

Path Finder

would something like this be valid?

... Module=Excel| eval Modx=if(Module="Excel" , "extension=xls OR extension=xlsx","extension=doc OR extension=docx") | search Modx

0 Karma

Path Finder

Well basically, in the base search it's something like Module=$field2$ that is guided by a drop down box. I wish to check if the module is A or if module is B then run this search otherwise run a regex.

0 Karma

Path Finder

I basically want to search different if the condition matches or fails.

0 Karma

Legend

You will have to give more details of what you are trying to do in else condition and what is the query you might run.

Also sample mock fields for Office and Not-office documents.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Path Finder

Basically, If the condition happens to be true, I want it to search by extension and return with stats. Otherwise, in the else part, I wish to run a regex.

0 Karma