Splunk Search

eval wildcards - using match in a case statement

Path Finder

Hi ,

I used match command in eval wildcards like below: shop_tags have many tags, A and B just two of them to identify different products.

eval products = case (match(product_tags,"A"), "a", match(shop_tags,"B"), "B")

However, I have product C, but it has two different types: e & f. I want to create a new name as C_old if it matches C & e, C_new if it matches C & f. I am not sure how to match two labels at the same time. I was trying:

eval products = case (match(product_tags,"A"), "a", match(shop_tags,"B"), "B",match(shop_tags,"C" & "e"), "C_old",match(shop_tags,"C" & "f"), "C_new")

but it is not working.

Can anyone help us to match two labels at the same time? Thanks very much.

Tags (4)
0 Karma


Provided an answer for a similar question. See here


0 Karma


Do these guys work together? Or just cheating on homework together 🙂


They're clearly not working together 🙂


Clearly 😜 Hey @hqw and @tenyang, if you're both colleagues, please don't post duplicate questions on Answers to avoid clutter on the site. If you're in fact one user using two different accounts and trying to get more visibility on your question by asking it twice, please refrain from doing this and only use one account.

@jplumsdaine22 & @sundareshr Thanks for all your awesome contributions and help here on Answers. It is very duly noted 😉


0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...