Splunk Search

help on eval command

jip31
Motivator

Hi
I dont know why my eval command doesnt return any resulys

 `index` 
| lookup tutu.csv HOSTNAME as host output SITE 
| stats values(SITE) as Site, values(index) AS index  BY host 
| eval check=if(index="ai-toto*" ,"toto index only","All indexes") 
| search check="toto index only" 
| table host 

If I delete the eval comamnd I have results
I have done a workaround like this:

| stats values(SITE) as Site, dc(index) AS index BY host 
| where NOT index==4

It works but I would like to know why my original search doesnt works

Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
  `index` 
 | lookup tutu.csv HOSTNAME as host output SITE 
 | stats values(SITE) as Site, values(index) AS index  BY host 
 | eval check=if(index="ai-toto*" ,"toto index only","All indexes") 
 | search check="toto index only" 
 | table host 

this query's index is multivalue.
so | eval check=if(index="ai-toto*" ,"toto index only","All indexes") is not work.

View solution in original post

0 Karma

to4kawa
Ultra Champion
  `index` 
 | lookup tutu.csv HOSTNAME as host output SITE 
 | stats values(SITE) as Site, values(index) AS index  BY host 
 | eval check=if(index="ai-toto*" ,"toto index only","All indexes") 
 | search check="toto index only" 
 | table host 

this query's index is multivalue.
so | eval check=if(index="ai-toto*" ,"toto index only","All indexes") is not work.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

try this:

`index` | lookup tutu.csv HOSTNAME as host output SITE | stats values(SITE) as Site, values(index) AS index BY host | mvexpand index | eval check=if(match(index,"ai-toto*") ,"toto index only","All indexes") | search check="toto index only" | dedup host | table host
0 Karma

jip31
Motivator

thanks its ok

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...