eval match with NOT condition

[kmaron]

I've figured out how to use the match condition to use a wildcard in my eval, however now I need to put at NOT with it and I'm stuck.

I have this which works

| eval NewDocType = case(match(Indexer,"ID*"),Document_Type)

But now I need the opposite where Indexer does NOT start with ID* to fill the field OriginalDocType with the Document_Type

[niketn]

@kmaron, try the following match condition for finding indexers not starting with ID:

| eval OriginalDocType=case(match(indexer,"^(?!^ID).*"),DocumentType)

Following is a run anywhere example.

| makeresults
| fields - _time
| eval indexer="ID3489724,SID203984,IDKJERH897,ADID90842ID"
| makemv indexer delim=","
| mvexpand indexer
| eval DocumentType="Test"
| eval OriginalDocType=case(match(indexer,"^(?!^ID).*"),DocumentType)

[kmaron]

When I ran this your way and then with the NOT that @somesoni2 mentioned the NOT came out a tiny bit faster but it's extremely fast in my tiny search anyway so the difference is negligible. Do you know which one would be more efficient?

[niketn]

@kmaron Use Job Inspector with some significant amount of data to test out the performance.

[somesoni2 · Accepted solution]

Just do like this

| eval NewDocType = case(NOT match(Indexer,"^ID"),Document_Type)

With match you can do partial match, no wildcard required. It actually uses regular expression (not like search wildcard), so your current expression will match all Indexer with which have ID* (0 or more occurrence of alphabet D)

[kmaron]

It seems so simple to just stick a NOT in there. Thank you for explaining about match!

[niketn]

@kmaron, to mark this question as answered, please accept the answer if this has helped.