Splunk Search

timecharting 2 seperate data sources with a case statement. What about this makes it so it will never get the label "msad", EVER

Path Finder

Something about this search makes it so we absolutely never get into the case that would label the column "msad". I have tried switching everything up: Making the zscaler case first, changing the msad case so that it just needs to meet the condition =* and every other tweak of syntax and values.

As an FYI, I have tried searching the default search separately and get events that meet both of the criteria mentioned in the case statement.

(index=zscaler) OR (index=msad) query=*debug*opendns*
 | eval field=case(index="msad" AND query="*debug*","msad",index="zscaler" AND query="debug.opendns.com","Zscaler", true(),"undefined")
 | timechart span=1h count by field

In this situation, it defaults to the undefined, which technically is all the events that I want labeled as msad and could change that to get desired results, but I'm posting this question because I am trying to understand the functionality of this command more then finding a workaround.

To me, it's very frustrating that the case statement will work with the zscaler events, but not with msad no matter how I change the case statement. I would really appreciate someone explaining the disconnect I am experiencing.

1 Solution

Esteemed Legend

You are mixing AND with OR without parentheses, which is always terrible, but the real problem is that eval and where treat * as a string literal. Check our or conference talk here:
https://www.youtube.com/watch?v=wAVnQIoH3Zc
In the meantime , try this:

((index=zscaler) OR (index=msad)) AND query="*debug*opendns*"
| eval field=case(index="msad" AND match(query, "debug"), "msad",
   index="zscaler" AND query="debug.opendns.com", "Zscaler",
   true(), "undefined")

| timechart span=1h count BY field

View solution in original post

0 Karma

Esteemed Legend

You are mixing AND with OR without parentheses, which is always terrible, but the real problem is that eval and where treat * as a string literal. Check our or conference talk here:
https://www.youtube.com/watch?v=wAVnQIoH3Zc
In the meantime , try this:

((index=zscaler) OR (index=msad)) AND query="*debug*opendns*"
| eval field=case(index="msad" AND match(query, "debug"), "msad",
   index="zscaler" AND query="debug.opendns.com", "Zscaler",
   true(), "undefined")

| timechart span=1h count BY field

View solution in original post

0 Karma

Path Finder

Thanks so much! I'll definitely check it out!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!