Splunk Search

eval wildcards - using match in a case statement

hqw
Path Finder

Hi ,

I used match command in eval wildcards like below: shop_tags have many tags, A and B just two of them to identify different products.

eval products = case (match(product_tags,"A"), "a", match(shop_tags,"B"), "B")

However, I have product C, but it has two different types: e & f. I want to create a new name as C_old if it matches C & e, C_new if it matches C & f. I am not sure how to match two labels at the same time. I was trying:

eval products = case (match(product_tags,"A"), "a", match(shop_tags,"B"), "B",match(shop_tags,"C" & "e"), "C_old",match(shop_tags,"C" & "f"), "C_new")

but it is not working.

Can anyone help us to match two labels at the same time? Thanks very much.

Tags (4)
0 Karma

sundareshr
Legend

Provided an answer for a similar question. See here

https://answers.splunk.com/answers/338838/eval-wildcard.html

0 Karma

jplumsdaine22
Influencer

Do these guys work together? Or just cheating on homework together 🙂

sundareshr
Legend

They're clearly not working together 🙂

ppablo
Community Manager
Community Manager

Clearly 😜 Hey @hqw and @tenyang, if you're both colleagues, please don't post duplicate questions on Answers to avoid clutter on the site. If you're in fact one user using two different accounts and trying to get more visibility on your question by asking it twice, please refrain from doing this and only use one account.

@jplumsdaine22 & @sundareshr Thanks for all your awesome contributions and help here on Answers. It is very duly noted 😉

Patrick

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>