Splunk Search

Why is my search eval not returning all expected fields?

kris99
New Member

stats count host. Below search only returning "Server and Count" not the Desktop.

index| dedup host | eval "Type"=case(host=="xxx*","Desktop", host!="xxx*","Server") | stats count(host) by Type |  rename count(host) AS Count | table Type Count

Need two row with Server & Desktop. If the host name starts with xxx its Desktop else its Server with count displayed

Tags (3)
0 Karma

akanno
Communicator

eval "Type"=if(match(host,"xxx.*"),"Desktop" ,"Server")
You can use match command like above.

http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/CommonEvalFunctions

Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...