Splunk Search

eval with wildcard

Path Finder

I am trying to use an eval but there is a wildcard so I noticed this does not work. Ho can I get this to work? I tried using match or Like but I cant get it working

......count(eval(logger ="blablabla test HTTP status: 200.")) OR logger="something id * HTTP status: 200") AS Example

Tags (2)
0 Karma

Influencer

If you are counting logs with status code 200, then extract status from logger and count it. You can use extracted field to count logs with other status codes also.

| rex field=logger "status:\s(?<status>[\d]+)" | stats count(eval(status=200)) AS count
0 Karma

SplunkTrust
SplunkTrust

@Mike6960

You can try this also.

YOUR_SEARCH | eval example= case(like(logger,"blablabla test HTTP status: 200."),1,like(logger,"something id % HTTP status: 200"),1,1=1,0) | stats sum(example) as example

Sample:

| makeresults 
| eval logger="blablabla test HTTP status: 200.|something id 1234 HTTPA status: 200|something id 1234 HTTP status: 200", logger=split(logger,"|") 
| mvexpand logger
| rename comment as "Upto this is for data generation only" 
| eval example= case(like(logger,"blablabla test HTTP status: 200."),1,like(logger,"something id % HTTP status: 200"),1,1=1,0)
| stats sum(example) as example
0 Karma

Ultra Champion

Try
|stats count(eval(like(logger,"%status: 200"))) as Example

0 Karma

Path Finder

Hi, what does 'category' do ?

0 Karma

Ultra Champion

sorry - should have been logger - amended in the answer.

0 Karma