Splunk Search

eval wildcards - using match in a case statement

Path Finder

Hi ,

I used match command in eval wildcards like below: shop_tags have many tags, A and B just two of them to identify different products.

eval products = case (match(product_tags,"A"), "a", match(shop_tags,"B"), "B")

However, I have product C, but it has two different types: e & f. I want to create a new name as C_old if it matches C & e, C_new if it matches C & f. I am not sure how to match two labels at the same time. I was trying:

eval products = case (match(product_tags,"A"), "a", match(shop_tags,"B"), "B",match(shop_tags,"C" & "e"), "C_old",match(shop_tags,"C" & "f"), "C_new")

but it is not working.

Can anyone help us to match two labels at the same time? Thanks very much.

Tags (4)
0 Karma

Legend

Provided an answer for a similar question. See here

https://answers.splunk.com/answers/338838/eval-wildcard.html

0 Karma

Influencer

Do these guys work together? Or just cheating on homework together 🙂

Legend

They're clearly not working together 🙂

Community Manager
Community Manager

Clearly 😜 Hey @hqw and @tenyang, if you're both colleagues, please don't post duplicate questions on Answers to avoid clutter on the site. If you're in fact one user using two different accounts and trying to get more visibility on your question by asking it twice, please refrain from doing this and only use one account.

@jplumsdaine22 & @sundareshr Thanks for all your awesome contributions and help here on Answers. It is very duly noted 😉

Patrick

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!