Splunk Search

Why does this eval case not work?

jaycetan
New Member
The following is my ideal final query to be used in a dashboard.
 

 

index=cdn_app httpMessage.host=taxes* 
| eval _env=$env_host$ 
| eval _hostName=case(_env=="http:abc-h123-apps-prod","taxes.sf.com", _env=="http:abc-h123-apps-qa", "taxes-qa.sf.com") 
| search httpMessage.host=_hostName 
| spath output=status path=httpMessage.status
| eval status=case(like(status, "2%"),"2xx",like(status, "4%"),"4xx",like(status, "5%"),"5xx") | stats count by status 

 

It seems `_hostName` is not resolving even when I hardcode and values like so.
 

 

index=cdn_app httpMessage.host=taxes* 
| eval _env="taxes.sf.com"
| eval _hostName=case(_env=="http:abc-h123-apps-prod","taxes.sf.com", _env=="http:abc-h123-apps-qa", "taxes-qa.sf.com") 
| search httpMessage.host=_hostName 
| stats count by httpMessage.host 

 

I'm sure its with my eval case because this works just fine.
 

 

index=cdn_app httpMessage.host=taxes* 
| search httpMessage.host="taxes.sf.com"
| stats count by httpMessage.host 

 

Open to any suggestions. Thanks!

 

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try with a where command

index=cdn_app httpMessage.host=taxes* 
| eval _env=$env_host$ 
| eval _hostName=case(_env=="http:abc-h123-apps-prod","taxes.sf.com", _env=="http:abc-h123-apps-qa", "taxes-qa.sf.com") 
| where httpMessage.host=_hostName 
| spath output=status path=httpMessage.status
| eval status=case(like(status, "2%"),"2xx",like(status, "4%"),"4xx",like(status, "5%"),"5xx") | stats count by status
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Avoid field names beginning with an underscore.  They (with a few exceptions) are hidden by Splunk.  Even most of the built-in underscored fields have to be copied to a regular field name before anything can be done with them - _index_time is a common example.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jaycetan
New Member

I initially had the values without the underscores. Unfortunately, removing them does not fix the issue. Appreciate the advice.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The case function is missing a default case so anything that doesn't match one of the two strings will be null.  Null hosts will be ignored by the stats command.

index=cdn_app httpMessage.host=taxes* 
| eval env="taxes.sf.com"
| eval hostName=case(env=="http:abc-h123-apps-prod","taxes.sf.com", 
                     env=="http:abc-h123-apps-qa", "taxes-qa.sf.com", 
                     1==1, "???") 
| search httpMessage.host = hostName 
| stats count by httpMessage.host 
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...