Splunk Search

eval, if, len, substr to produce specific results

noob4now
New Member

So far, I've had success with the following command:
eval Port=if(len(Port)>=22,substr(Port,1,len(Port)-2),Port)
This checks to see if a Sport result is >= 22, then subtracts 2 characters from the end. I get good results but they need to be specific to a particular search result.

The output I'm concerned with specifically is "Ethernet%" and everything else should be left alone by the above statement. I'm sure this is a simple fix, but I can't quite figure out how to put it all togehter...

I'm thinking it should start with:
eval Port=if(Port="Ethernet%" <--- from here, I'm a bit lost on how to put it together with the above statement.

Tags (4)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@noob4now,

Try using nested if

| eval Port=if(match(Port,"Ethernet"),if(len(Port)>=22,substr(Port,1,len(Port)-2),Port),Port)
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...