Splunk Search

Using Eval to Filter Values

jason_hotchkiss
Communicator

Hello Splunkers - 

I am trying to filter any value that is wrapped in $, such as $host$or $value$.  I thought the below would work, but it is not.  Can someone point out what I am doing wrong?  Thanks!

| eval dollar_sign=if(host_value=="$host$" OR host_value=="$value$", "yes", "no")
| search NOT dollar_sign=yes


Labels (1)
0 Karma
1 Solution

johnhuang
Motivator
| eval dollar_sign=IF(LIKE(host_value, "$%$"), "yes", "no")

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you are using this in a dashboard, the dollar signs have to be doubled up otherwise it is looking for tokens

| eval dollar_sign=if(host_value=="$$host$$" OR host_value=="$$value$$", "yes", "no")
| search NOT dollar_sign=yes
0 Karma

jason_hotchkiss
Communicator

I will keep this in mind if I end up using this in a dashboard.  Thank you @ITWhisperer 

0 Karma

johnhuang
Motivator
| eval dollar_sign=IF(LIKE(host_value, "$%$"), "yes", "no")
0 Karma

jason_hotchkiss
Communicator

This solved my use case.  Thank you @johnhuang 

0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...

Bridging the Gap: Splunk Helps Students Move from Classroom to Career

The Splunk Community is a powerful network of users, educators, and organizations working together to tackle ...