Why is the splunk eval case with special characters not working?

[Chandras11]

Hi everyone,

when I try to use the following command, it always gives in CA_flag as "Other" although lower_Ticket_Desc has a exact maching term. Is there something, which I am not doing correctly here :

| eval lower_Ticket_Desc = lower(TICKET_DESC)| rex field=lower_Ticket_Desc mode=sed "s/ //g"|eval CA_flag = case(lower_Ticket_Desc=="[yes/no]:no" ,"Flag_NO" ,lower_Ticket_Desc=="[yes/no]:yes"  ,"Flag_YES" , 1=1, "Other" )  | 

I have removed all blank spaces and converted everything to lower case.

TICKET_DESC example = "asdfjkasdhf [Yes/No]: No dfasjaskl" Or "asdfjkasdhf [Yes/No]:no asdfadsf" or "asdfjkasdhf [Yes/No]: YES asdfadsf"

[niketn]

@Chandras11, please try the following case() statement

| eval CA_flag = case(match(lower_Ticket_Desc,"^\[yes\/no\]:no$") ,"Flag_NO",
                     match(lower_Ticket_Desc,"^\[yes\/no\]:yes$") ,"Flag_YES",
                     1=1, "Other")

Following is a run anywhere search for testing:

| makeresults 
| eval lower_Ticket_Desc="[yes/no]:yes" 
| eval CA_flag = case(match(lower_Ticket_Desc,"^\[yes\/no\]:no$") ,"Flag_NO",
                 match(lower_Ticket_Desc,"^\[yes\/no\]:yes$") ,"Flag_YES",
                 1=1, "Other")

[FrankVl]

I don't think those regular expressions are correct, given that the field values look like this (according to his examples): "asdfjkasdhf [Yes/No]: No dfasjaskl"

If your regex would have been correct, then his original == would also have worked, right?

Just remove the ^ and $ signs and it would work.

[FrankVl · Accepted solution]

That's because your case statement uses == comparison operator, which requires an exact match. While your match string is a substring of the actual field value.

Try the following using like() and adding % signs before and after the match string:

| eval lower_Ticket_Desc = lower(TICKET_DESC) 
| rex field=lower_Ticket_Desc mode=sed "s/ //g" 
| eval CA_flag = case(like(lower_Ticket_Desc,"%[yes/no]:no%") ,"Flag_NO" ,like(lower_Ticket_Desc,"%[yes/no]:yes%") ,"Flag_YES" , 1=1, "Other" )

[niketn]

@FrankVl, nothing new... again you beat me to it. I posted a different approach but too late 😉

[Chandras11]

@niketnilay : Its always good to have more than one approach:)

[Chandras11]

Thanks Frank.. you reduced one common mistake, which I do regularly 🙂