Splunk Search

Why is eval case not evaluating fields?

lemospt
Explorer

Hi,

 

i have a field with the models, like below, and with this info i want to define a new field like brand.

lemospt_0-1689847454131.png

i tried different approaches but can't get brand field populated, below a test search with different case, none works but where clause works well.

 

index=core_ct_report_*
| where (report_model = "cfgHT802")
| eval brand=case(report_model=cfgHT802, grandstream)
| eval brand2=case(like(report_model, cfgHT802), grandstream)
| eval brand3=case(like(report_model, "cfg%"), grandstream)
| table report_model brand brand2 brand3

lemospt_1-1689847761965.png

what is wrong?

What i need is something like this,

| eval brand3=case(like(report_model, "cfg%"), grandstream, ...)

Thanks,

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

What is grandstream? If it is a field with content, then at least brand3 should have worked. If it is supposed to be a string, then it needs to be quoted (as do the other strings

| eval brand=case(report_model="cfgHT802", "grandstream")
| eval brand2=case(like(report_model, "cfgHT802"), "grandstream")
| eval brand3=case(like(report_model, "cfg%"), "grandstream")

View solution in original post

0 Karma

lemospt
Explorer

Thanks both for the inputs @ITWhisperer @yuanliu 

the problem is the missing double quotes on the true condition like @ITWhisperer said.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What is grandstream? If it is a field with content, then at least brand3 should have worked. If it is supposed to be a string, then it needs to be quoted (as do the other strings

| eval brand=case(report_model="cfgHT802", "grandstream")
| eval brand2=case(like(report_model, "cfgHT802"), "grandstream")
| eval brand3=case(like(report_model, "cfg%"), "grandstream")
0 Karma

yuanliu
SplunkTrust
SplunkTrust

First, note that screenshots are very unfavorable for volunteers.  Please use text for illustration wherever possible.

Secondly, SPL interprets bare strings on the right-hand side (evaluation expressions) as field names.  To match strings, you need to quote them properly.

index=core_ct_report_*
| where (report_model = "cfgHT802")
| eval brand=case(report_model=="cfgHT802", grandstream)
| eval brand2=case(like(report_model, "cfgHT802"), grandstream)
| eval brand3=case(like(report_model, "cfg%"), grandstream)
| table report_model brand brand2 brand3
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...