Splunk Search

case match command

parkertctr
Explorer

I am trying to use the case match command with more than one option. I keep getting an error message regarding the parenthesis.. nothing is working.. Do not understand whats missing from the syntax.   Here is the search -->

| eval state_ack_error=case(match(_raw, "ACK\-CODE\=AA"), 1, match(_raw matches "STATUS\=SENT"), 1, 1=1, 0)

Error message: Error in 'eval' command: The expression is malformed.

Labels (2)
Tags (2)
0 Karma

somesoni2
Revered Legend

Your second match command is not written in correct syntax. Try this:

|  eval state_ack_error=case(match(_raw,"ACK\-CODE\=AA"), 1, match(_raw, "STATUS\=SENT"), 1, 1=1, 0)

parkertctr
Explorer

Thank you. 

0 Karma