eval wildcards

[gnovak]

I have a search that uses some wildcards:

sourcetype="EPPWEB" source="/opt/log/*/web_server/info.log" WAT 
| rex field=_raw "USER (?P<registrar>\[\d+-\w\w\]) downloading .*/(?<filename>.+?)$" 
| search filename=Invoice.pdf OR filename=Statement.pdf OR filename=text.txt OR filename=*-*.pdf OR filename=*-*_invoice.html NOT filename=*-*_*.pdf 
| eval Actual=case(filename="Statement.pdf","Billing Statement",
                   filename="Invoice.pdf","Billing Invoice",
                   filename="text.txt","Billing Text",
                   filename="*-*.pdf","Scorecard",
                   filename="*-*_invoice.html","Drilldown Invoice")

You'll notice at the end of my eval command I used wildcards for the filenames. However, when I run this search the 2 filenames I identified in the eval command that are using wildcards will NOT show up in the Actual field. They show up as events and I can clearly see a line from the logs containing these filenames, but they aren't being assigned the filename I specified in the eval command.

Does eval not like wildcards???

[lguinn2 · Accepted solution]

No, eval does not like wildcards. And you should also be using == instead of = in your case statement. Try the match function to deal with wildcards explicitly - but remember that match uses regular expressions.

sourcetype="EPPWEB" source="/opt/log/*/web_server/info.log" WAT 
| rex field=_raw "USER (?P<registrar>\[\d+-\w\w\]) downloading .*/(?<filename>.+?)$" 
| search filename=Invoice.pdf OR filename=Statement.pdf OR filename=text.txt OR filename=*-*.pdf OR filename=*-*_invoice.html NOT filename=*-*_*.pdf 
| eval Actual=case(filename=="Statement.pdf","Billing Statement",
                   filename=="Invoice.pdf","Billing Invoice",
                   filename=="text.txt","Billing Text",
                   match(filename,".*-.*\.pdf$"),"Scorecard",
                   match(filename,".*-.*_invoice\.html$"),"Drilldown Invoice")

This may work. Please comment if it doesn't!

[rfiscus]

Worked for me as well, thank you!

[smitra_splunk]

worked!!
Thanks. 🙂

[gnovak]

It did work. Thank you very much!

[psciegienny]

Hi, sorry for downvote misclick. I look at it again and match function is very useful.