Splunk Search

eval command help

yosplunksunny
New Member

Hi All,

Need help to get the values from multi field value. We have a field name "properties.targetResources{}.displayName" which has the multiple field value. Now when we have the field "operationName"="Add member to role completed (PIM activation) then we need to have the new field let's say "dest" field should pick 3rd value from field "properties.targetResources{}.displayName" . And when operationName = Add member to role request denied (PIM activation) then "dest" field should pick value 4th from field "properties.targetResources{}.displayName" .

Splunk search for single field mvindex is working fine

sourcetype="amdl:aadal:audit"  operationName="Add member to role completed (PIM activation)" | eval dest = case(operationName=="Add member to role completed (PIM activation)", mvindex('properties.targetResources{}.displayName',3))  | table dest

Splunk search for mutiple field value is not working fine

sourcetype="amdl:aadal:audit"  operationName=* | eval dest = if(case(operationName=="Add member to role completed (PIM activation)", mvindex('properties.targetResources{}.displayName',3)),  case(operationName = Add member to role request denied (PIM activation)
, mvindex('properties.targetResources{}.displayName',4))  | table dest

In this case eval is written wrong , need to fix this .

Thanks in advance

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@yosplunksunny,

Please refer to the usage of case and try below

    sourcetype="amdl:aadal:audit"  operationName=* 
   | eval dest =  case(operationName=="Add member to role completed (PIM activation)",mvindex('properties.targetResources{}.displayName',3)  
                       ,operationName = "Add member to role request denied (PIM activation)" mvindex('properties.targetResources{}.displayName',4),
                       ,true(),"Your default value"
                     )
  |table dest
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@yosplunksunny,

Please refer to the usage of case and try below

    sourcetype="amdl:aadal:audit"  operationName=* 
   | eval dest =  case(operationName=="Add member to role completed (PIM activation)",mvindex('properties.targetResources{}.displayName',3)  
                       ,operationName = "Add member to role request denied (PIM activation)" mvindex('properties.targetResources{}.displayName',4),
                       ,true(),"Your default value"
                     )
  |table dest
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...