Splunk Search

eval, if, len, substr to produce specific results

noob4now
New Member

So far, I've had success with the following command:
eval Port=if(len(Port)>=22,substr(Port,1,len(Port)-2),Port)
This checks to see if a Sport result is >= 22, then subtracts 2 characters from the end. I get good results but they need to be specific to a particular search result.

The output I'm concerned with specifically is "Ethernet%" and everything else should be left alone by the above statement. I'm sure this is a simple fix, but I can't quite figure out how to put it all togehter...

I'm thinking it should start with:
eval Port=if(Port="Ethernet%" <--- from here, I'm a bit lost on how to put it together with the above statement.

Tags (4)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@noob4now,

Try using nested if

| eval Port=if(match(Port,"Ethernet"),if(len(Port)>=22,substr(Port,1,len(Port)-2),Port),Port)
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...