Splunk Search

if match eval with an or

jclemons7
Path Finder

Hello,

I'm trying to create an eval statement that evaluates if a string exists OR another string exists. For example, I'd like to say:

if "\cmd.exe" or "\test.exe /switch" then 1 else 0

So I have the following "attempt":

| eval exe_count=if(match(lower(CommandLine),"\cmd.exe" OR "\\\test.exe \\/switch"),1,0)

But it doesn't seem to work.. so I'm wondering what I'm doing wrong..

Thanks in advance.

1 Solution

richgalloway
SplunkTrust
SplunkTrust

Perhaps it was left out from the question, but the first comparator needs to be escaped. Also, the match command expects a single string for its second argument. Try this.

... | eval exe_count=case(match(lower(CommandLine),"\\\cmd.exe"),1, match(lower(CommandLine),"\\\test.exe \/switch"),1, 1=1,0)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Perhaps it was left out from the question, but the first comparator needs to be escaped. Also, the match command expects a single string for its second argument. Try this.

... | eval exe_count=case(match(lower(CommandLine),"\\\cmd.exe"),1, match(lower(CommandLine),"\\\test.exe \/switch"),1, 1=1,0)
---
If this reply helps you, Karma would be appreciated.

jclemons7
Path Finder

The force is strong with you.. thank you so much for your help, that's exactly what I was looking for.

Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...