Splunk Search

Why is eval case not evaluating fields?

lemospt
Explorer

Hi,

 

i have a field with the models, like below, and with this info i want to define a new field like brand.

lemospt_0-1689847454131.png

i tried different approaches but can't get brand field populated, below a test search with different case, none works but where clause works well.

 

index=core_ct_report_*
| where (report_model = "cfgHT802")
| eval brand=case(report_model=cfgHT802, grandstream)
| eval brand2=case(like(report_model, cfgHT802), grandstream)
| eval brand3=case(like(report_model, "cfg%"), grandstream)
| table report_model brand brand2 brand3

lemospt_1-1689847761965.png

what is wrong?

What i need is something like this,

| eval brand3=case(like(report_model, "cfg%"), grandstream, ...)

Thanks,

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

What is grandstream? If it is a field with content, then at least brand3 should have worked. If it is supposed to be a string, then it needs to be quoted (as do the other strings

| eval brand=case(report_model="cfgHT802", "grandstream")
| eval brand2=case(like(report_model, "cfgHT802"), "grandstream")
| eval brand3=case(like(report_model, "cfg%"), "grandstream")

View solution in original post

0 Karma

lemospt
Explorer

Thanks both for the inputs @ITWhisperer @yuanliu 

the problem is the missing double quotes on the true condition like @ITWhisperer said.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What is grandstream? If it is a field with content, then at least brand3 should have worked. If it is supposed to be a string, then it needs to be quoted (as do the other strings

| eval brand=case(report_model="cfgHT802", "grandstream")
| eval brand2=case(like(report_model, "cfgHT802"), "grandstream")
| eval brand3=case(like(report_model, "cfg%"), "grandstream")
0 Karma

yuanliu
SplunkTrust
SplunkTrust

First, note that screenshots are very unfavorable for volunteers.  Please use text for illustration wherever possible.

Secondly, SPL interprets bare strings on the right-hand side (evaluation expressions) as field names.  To match strings, you need to quote them properly.

index=core_ct_report_*
| where (report_model = "cfgHT802")
| eval brand=case(report_model=="cfgHT802", grandstream)
| eval brand2=case(like(report_model, "cfgHT802"), grandstream)
| eval brand3=case(like(report_model, "cfg%"), grandstream)
| table report_model brand brand2 brand3
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...