Splunk Search

if match eval with an or

jclemons7
Path Finder

Hello,

I'm trying to create an eval statement that evaluates if a string exists OR another string exists. For example, I'd like to say:

if "\cmd.exe" or "\test.exe /switch" then 1 else 0

So I have the following "attempt":

| eval exe_count=if(match(lower(CommandLine),"\cmd.exe" OR "\\\test.exe \\/switch"),1,0)

But it doesn't seem to work.. so I'm wondering what I'm doing wrong..

Thanks in advance.

1 Solution

richgalloway
SplunkTrust
SplunkTrust

Perhaps it was left out from the question, but the first comparator needs to be escaped. Also, the match command expects a single string for its second argument. Try this.

... | eval exe_count=case(match(lower(CommandLine),"\\\cmd.exe"),1, match(lower(CommandLine),"\\\test.exe \/switch"),1, 1=1,0)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Perhaps it was left out from the question, but the first comparator needs to be escaped. Also, the match command expects a single string for its second argument. Try this.

... | eval exe_count=case(match(lower(CommandLine),"\\\cmd.exe"),1, match(lower(CommandLine),"\\\test.exe \/switch"),1, 1=1,0)
---
If this reply helps you, Karma would be appreciated.

jclemons7
Path Finder

The force is strong with you.. thank you so much for your help, that's exactly what I was looking for.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...