Splunk Search
Highlighted

Simple search with eval. Why is no table shown?

Path Finder

Here is the search:

index=* sourcetype=Vectra-CEF vendor="Vectra Networks" cat!="HOST SCORING" |eval check_cat=case(cat="Command & Control" OR cat="Reconnaissance" OR cat="Lateral Movement" OR cat="Botnet Activity" OR cat="Exfiltration","true")| table cat | where check_cat="true" 

I get events back from the search,t but the table is not built up.

0 Karma
Highlighted

Re: Simple search with eval. Why is no table shown?

SplunkTrust
SplunkTrust

Does Verbose Mode show events with the 'cat' field having the specified values?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Simple search with eval. Why is no table shown?

Path Finder

Yes, the 'cat' field has specified values. But for some reason the eval filter does not work. The events also show cat field values excluded in the eval filter.

0 Karma
Highlighted

Re: Simple search with eval. Why is no table shown?

SplunkTrust
SplunkTrust

The table command you used is limiting the fields to just cat, hence your where clause is failing as the field check_cat is not available. Try like this

index=* sourcetype=Vectra-CEF vendor="Vectra Networks" cat!="HOST SCORING" |eval check_cat=case(cat="Command & Control" OR cat="Reconnaissance" OR cat="Lateral Movement" OR cat="Botnet Activity" OR cat="Exfiltration","true") | where check_cat="true" 
 | table cat 

OR more efficient method

  index=* sourcetype=Vectra-CEF vendor="Vectra Networks" cat="Command & Control" OR cat="Reconnaissance" OR cat="Lateral Movement" OR cat="Botnet Activity" OR cat="Exfiltration"   | table cat 

View solution in original post

0 Karma
Highlighted

Re: Simple search with eval. Why is no table shown?

Path Finder

Thanks both searches work. I realized that the Boolean expressions are case sensitive thats why my searches also did not work.

0 Karma
Highlighted

Re: Simple search with eval. Why is no table shown?

SplunkTrust
SplunkTrust

Yes, when used in EVAL/WHERE strings are case-sensitive, but if used in base search OR SEARCH command, they are not.

0 Karma
Highlighted

Re: Simple search with eval. Why is no table shown?

Builder

Why use case() here instead of if()?

0 Karma
Highlighted

Re: Simple search with eval. Why is no table shown?

Ultra Champion

there is no else operation.

0 Karma
Highlighted

Re: Simple search with eval. Why is no table shown?

Builder

Sure there is: |eval check_cat=if(cat="Command & Control" OR cat="Reconnaissance" OR cat="Lateral Movement" OR cat="Botnet Activity" OR cat="Exfiltration","true",null())

0 Karma