Splunk Search

eval match with NOT condition

kmaron
Motivator

I've figured out how to use the match condition to use a wildcard in my eval, however now I need to put at NOT with it and I'm stuck.

I have this which works

| eval NewDocType = case(match(Indexer,"ID*"),Document_Type)

But now I need the opposite where Indexer does NOT start with ID* to fill the field OriginalDocType with the Document_Type

0 Karma
1 Solution

somesoni2
Revered Legend

Just do like this

| eval NewDocType = case(NOT match(Indexer,"^ID"),Document_Type)

With match you can do partial match, no wildcard required. It actually uses regular expression (not like search wildcard), so your current expression will match all Indexer with which have ID* (0 or more occurrence of alphabet D)

View solution in original post

niketnilay
Legend

@kmaron, try the following match condition for finding indexers not starting with ID:

| eval OriginalDocType=case(match(indexer,"^(?!^ID).*"),DocumentType)

Following is a run anywhere example.

| makeresults
| fields - _time
| eval indexer="ID3489724,SID203984,IDKJERH897,ADID90842ID"
| makemv indexer delim=","
| mvexpand indexer
| eval DocumentType="Test"
| eval OriginalDocType=case(match(indexer,"^(?!^ID).*"),DocumentType)
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

kmaron
Motivator

When I ran this your way and then with the NOT that @somesoni2 mentioned the NOT came out a tiny bit faster but it's extremely fast in my tiny search anyway so the difference is negligible. Do you know which one would be more efficient?

0 Karma

niketnilay
Legend

@kmaron Use Job Inspector with some significant amount of data to test out the performance.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
Revered Legend

Just do like this

| eval NewDocType = case(NOT match(Indexer,"^ID"),Document_Type)

With match you can do partial match, no wildcard required. It actually uses regular expression (not like search wildcard), so your current expression will match all Indexer with which have ID* (0 or more occurrence of alphabet D)

View solution in original post

kmaron
Motivator

It seems so simple to just stick a NOT in there. Thank you for explaining about match!

0 Karma

niketnilay
Legend

@kmaron, to mark this question as answered, please accept the answer if this has helped.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!