...escription"=(Message) OR (name) | table ... "Event Description"
.... | eval "Event Description"=Message OR name | table ... "Event Description"
None of these seem to work. They usually give us malform eval express...
...sed "(Image!=[process1] AND Image!=[Process2])" and "NOT (Image=[process1] OR Image=[process2])"
I would appreciate if you tell me the difference between these two booleanexpressions.
Hi, One of my value in table is being passed as an Booleanexpression as below
(assignment_group = 1213App_Development1 OR assignment_group = App-Testing OR assignment_group = App Support OR a...
I know this is a Splunk newbie question but I am having some issues getting this to work. I have a column field named "Account_Name" from a sourcetype="AD", for instance. I am creating a form where t...
...roviding too many logical/OR expressions is there a way I can put all these values A, B, C, D ....& Z in a table and write something like...search if field2 is in the table...?
...reated it as a calculated field(systemid) and gave an eval expression systemid=if(isnull(systemid),"NULL",systemid). Now I get the error "Error in 'eval' command: Fields cannot be assigned a boolean r...
...MLField
I've got tens of regular expressions working as field extractions, I've got this particular expression working in search and in a python script, I'm just really out of ideas as to why it's n...
Hello,
How do I combine two searches in an eval command? In the example below, I'm trying to create a value for "followup_live_agent" and "caller_silence" values. Splunk is telling me this query is...
...ilter results from the lookup table before returning data. Create this filter like you would a typical search query using Booleanexpressions and/or comparison operators. Obviously mvindex is not Boolean...