Splunk Search

eval wildcards

gnovak
Builder

I have a search that uses some wildcards:

sourcetype="EPPWEB" source="/opt/log/*/web_server/info.log" WAT 
| rex field=_raw "USER (?P<registrar>\[\d+-\w\w\]) downloading .*/(?<filename>.+?)$" 
| search filename=Invoice.pdf OR filename=Statement.pdf OR filename=text.txt OR filename=*-*.pdf OR filename=*-*_invoice.html NOT filename=*-*_*.pdf 
| eval Actual=case(filename="Statement.pdf","Billing Statement",
                   filename="Invoice.pdf","Billing Invoice",
                   filename="text.txt","Billing Text",
                   filename="*-*.pdf","Scorecard",
                   filename="*-*_invoice.html","Drilldown Invoice")

You'll notice at the end of my eval command I used wildcards for the filenames. However, when I run this search the 2 filenames I identified in the eval command that are using wildcards will NOT show up in the Actual field. They show up as events and I can clearly see a line from the logs containing these filenames, but they aren't being assigned the filename I specified in the eval command.

Does eval not like wildcards???

Tags (1)
1 Solution

lguinn2
Legend

No, eval does not like wildcards. And you should also be using == instead of = in your case statement. Try the match function to deal with wildcards explicitly - but remember that match uses regular expressions.

sourcetype="EPPWEB" source="/opt/log/*/web_server/info.log" WAT 
| rex field=_raw "USER (?P<registrar>\[\d+-\w\w\]) downloading .*/(?<filename>.+?)$" 
| search filename=Invoice.pdf OR filename=Statement.pdf OR filename=text.txt OR filename=*-*.pdf OR filename=*-*_invoice.html NOT filename=*-*_*.pdf 
| eval Actual=case(filename=="Statement.pdf","Billing Statement",
                   filename=="Invoice.pdf","Billing Invoice",
                   filename=="text.txt","Billing Text",
                   match(filename,".*-.*\.pdf$"),"Scorecard",
                   match(filename,".*-.*_invoice\.html$"),"Drilldown Invoice")

This may work. Please comment if it doesn't!

View solution in original post

lguinn2
Legend

No, eval does not like wildcards. And you should also be using == instead of = in your case statement. Try the match function to deal with wildcards explicitly - but remember that match uses regular expressions.

sourcetype="EPPWEB" source="/opt/log/*/web_server/info.log" WAT 
| rex field=_raw "USER (?P<registrar>\[\d+-\w\w\]) downloading .*/(?<filename>.+?)$" 
| search filename=Invoice.pdf OR filename=Statement.pdf OR filename=text.txt OR filename=*-*.pdf OR filename=*-*_invoice.html NOT filename=*-*_*.pdf 
| eval Actual=case(filename=="Statement.pdf","Billing Statement",
                   filename=="Invoice.pdf","Billing Invoice",
                   filename=="text.txt","Billing Text",
                   match(filename,".*-.*\.pdf$"),"Scorecard",
                   match(filename,".*-.*_invoice\.html$"),"Drilldown Invoice")

This may work. Please comment if it doesn't!

rfiscus
Path Finder

Worked for me as well, thank you!

0 Karma

smitra_splunk
Splunk Employee
Splunk Employee

worked!!
Thanks. 🙂

0 Karma

gnovak
Builder

It did work. Thank you very much!

0 Karma

psciegienny
New Member

Hi, sorry for downvote misclick. I look at it again and match function is very useful.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...