Splunk Search

Using Eval to Filter Values

jason_hotchkiss
Communicator

Hello Splunkers - 

I am trying to filter any value that is wrapped in $, such as $host$or $value$.  I thought the below would work, but it is not.  Can someone point out what I am doing wrong?  Thanks!

| eval dollar_sign=if(host_value=="$host$" OR host_value=="$value$", "yes", "no")
| search NOT dollar_sign=yes


Labels (1)
0 Karma
1 Solution

johnhuang
Motivator
| eval dollar_sign=IF(LIKE(host_value, "$%$"), "yes", "no")

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you are using this in a dashboard, the dollar signs have to be doubled up otherwise it is looking for tokens

| eval dollar_sign=if(host_value=="$$host$$" OR host_value=="$$value$$", "yes", "no")
| search NOT dollar_sign=yes
0 Karma

jason_hotchkiss
Communicator

I will keep this in mind if I end up using this in a dashboard.  Thank you @ITWhisperer 

0 Karma

johnhuang
Motivator
| eval dollar_sign=IF(LIKE(host_value, "$%$"), "yes", "no")
0 Karma

jason_hotchkiss
Communicator

This solved my use case.  Thank you @johnhuang 

0 Karma
Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...