Splunk Search

eval wildcards

gnovak
Builder

I have a search that uses some wildcards:

sourcetype="EPPWEB" source="/opt/log/*/web_server/info.log" WAT 
| rex field=_raw "USER (?P<registrar>\[\d+-\w\w\]) downloading .*/(?<filename>.+?)$" 
| search filename=Invoice.pdf OR filename=Statement.pdf OR filename=text.txt OR filename=*-*.pdf OR filename=*-*_invoice.html NOT filename=*-*_*.pdf 
| eval Actual=case(filename="Statement.pdf","Billing Statement",
                   filename="Invoice.pdf","Billing Invoice",
                   filename="text.txt","Billing Text",
                   filename="*-*.pdf","Scorecard",
                   filename="*-*_invoice.html","Drilldown Invoice")

You'll notice at the end of my eval command I used wildcards for the filenames. However, when I run this search the 2 filenames I identified in the eval command that are using wildcards will NOT show up in the Actual field. They show up as events and I can clearly see a line from the logs containing these filenames, but they aren't being assigned the filename I specified in the eval command.

Does eval not like wildcards???

Tags (1)
1 Solution

lguinn2
Legend

No, eval does not like wildcards. And you should also be using == instead of = in your case statement. Try the match function to deal with wildcards explicitly - but remember that match uses regular expressions.

sourcetype="EPPWEB" source="/opt/log/*/web_server/info.log" WAT 
| rex field=_raw "USER (?P<registrar>\[\d+-\w\w\]) downloading .*/(?<filename>.+?)$" 
| search filename=Invoice.pdf OR filename=Statement.pdf OR filename=text.txt OR filename=*-*.pdf OR filename=*-*_invoice.html NOT filename=*-*_*.pdf 
| eval Actual=case(filename=="Statement.pdf","Billing Statement",
                   filename=="Invoice.pdf","Billing Invoice",
                   filename=="text.txt","Billing Text",
                   match(filename,".*-.*\.pdf$"),"Scorecard",
                   match(filename,".*-.*_invoice\.html$"),"Drilldown Invoice")

This may work. Please comment if it doesn't!

View solution in original post

lguinn2
Legend

No, eval does not like wildcards. And you should also be using == instead of = in your case statement. Try the match function to deal with wildcards explicitly - but remember that match uses regular expressions.

sourcetype="EPPWEB" source="/opt/log/*/web_server/info.log" WAT 
| rex field=_raw "USER (?P<registrar>\[\d+-\w\w\]) downloading .*/(?<filename>.+?)$" 
| search filename=Invoice.pdf OR filename=Statement.pdf OR filename=text.txt OR filename=*-*.pdf OR filename=*-*_invoice.html NOT filename=*-*_*.pdf 
| eval Actual=case(filename=="Statement.pdf","Billing Statement",
                   filename=="Invoice.pdf","Billing Invoice",
                   filename=="text.txt","Billing Text",
                   match(filename,".*-.*\.pdf$"),"Scorecard",
                   match(filename,".*-.*_invoice\.html$"),"Drilldown Invoice")

This may work. Please comment if it doesn't!

rfiscus
Path Finder

Worked for me as well, thank you!

0 Karma

smitra_splunk
Splunk Employee
Splunk Employee

worked!!
Thanks. 🙂

0 Karma

gnovak
Builder

It did work. Thank you very much!

0 Karma

psciegienny
New Member

Hi, sorry for downvote misclick. I look at it again and match function is very useful.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...