Splunk Search

eval match with NOT condition

kmaron
Motivator

I've figured out how to use the match condition to use a wildcard in my eval, however now I need to put at NOT with it and I'm stuck.

I have this which works

| eval NewDocType = case(match(Indexer,"ID*"),Document_Type)

But now I need the opposite where Indexer does NOT start with ID* to fill the field OriginalDocType with the Document_Type

0 Karma
1 Solution

somesoni2
Revered Legend

Just do like this

| eval NewDocType = case(NOT match(Indexer,"^ID"),Document_Type)

With match you can do partial match, no wildcard required. It actually uses regular expression (not like search wildcard), so your current expression will match all Indexer with which have ID* (0 or more occurrence of alphabet D)

View solution in original post

niketn
Legend

@kmaron, try the following match condition for finding indexers not starting with ID:

| eval OriginalDocType=case(match(indexer,"^(?!^ID).*"),DocumentType)

Following is a run anywhere example.

| makeresults
| fields - _time
| eval indexer="ID3489724,SID203984,IDKJERH897,ADID90842ID"
| makemv indexer delim=","
| mvexpand indexer
| eval DocumentType="Test"
| eval OriginalDocType=case(match(indexer,"^(?!^ID).*"),DocumentType)
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

kmaron
Motivator

When I ran this your way and then with the NOT that @somesoni2 mentioned the NOT came out a tiny bit faster but it's extremely fast in my tiny search anyway so the difference is negligible. Do you know which one would be more efficient?

0 Karma

niketn
Legend

@kmaron Use Job Inspector with some significant amount of data to test out the performance.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
Revered Legend

Just do like this

| eval NewDocType = case(NOT match(Indexer,"^ID"),Document_Type)

With match you can do partial match, no wildcard required. It actually uses regular expression (not like search wildcard), so your current expression will match all Indexer with which have ID* (0 or more occurrence of alphabet D)

kmaron
Motivator

It seems so simple to just stick a NOT in there. Thank you for explaining about match!

0 Karma

niketn
Legend

@kmaron, to mark this question as answered, please accept the answer if this has helped.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...