Splunk Search
Highlighted

if match eval with an or

Path Finder

Hello,

I'm trying to create an eval statement that evaluates if a string exists OR another string exists. For example, I'd like to say:

if "\cmd.exe" or "\test.exe /switch" then 1 else 0

So I have the following "attempt":

| eval exe_count=if(match(lower(CommandLine),"\cmd.exe" OR "\\\test.exe \\/switch"),1,0)

But it doesn't seem to work.. so I'm wondering what I'm doing wrong..

Thanks in advance.

Highlighted

Re: if match eval with an or

SplunkTrust
SplunkTrust

Perhaps it was left out from the question, but the first comparator needs to be escaped. Also, the match command expects a single string for its second argument. Try this.

... | eval exe_count=case(match(lower(CommandLine),"\\\cmd.exe"),1, match(lower(CommandLine),"\\\test.exe \/switch"),1, 1=1,0)
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Highlighted

Re: if match eval with an or

Path Finder

The force is strong with you.. thank you so much for your help, that's exactly what I was looking for.

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.