I am using the following eval command. I want the type column to pick up both the sources. index=xyz (source=smf015 OR source=smf014) | stats values(source) as source by JFCBDSNM DATETIME S...
Hi All, Is it possible to perform Eval then perform lookup ? If the eval return null then perform lookupA.csv. If eval return notnull, then perform lookupB.csv thanks!
Hi all,
During evaluating round I got the error:
| stats avg(duration) AS "booking average time" by hours
| eval "booking average time"=round("booking average time",2)
Error in 'eval' c...
We all know that manipulating _MetaData:Index we can redirect some events to another index. But the question is - can we do it using Ingest-time evals? For example - using lookup() function to s...
Hello Splunkers, I am trying to write is a condition that says if command starts with "CHA" or "INS" add one. The Query: host=*| eval AUDIT=if(like(COMMAND,"CHA % AUDIT%", "INS % AUDIT%"),1...
Hi, I wonder whether someone can help me please.
I'm using number the following as part of a query to extract data from a summary Index
| stats count(eval(repayments_submit="1")) as r...
...bsp; Product , a, b, c, d, In_Spec I would like to use eval to assign the value to In_Spec |eval In_Spec=( if Product=1 and a1<a<a2 and b1<b<b2 and c1<c<c2, "yes", "no") b...
...t;.+?)$"
| search filename=Invoice.pdf OR filename=Statement.pdf OR filename=text.txt OR filename=*-*.pdf OR filename=*-*_invoice.html NOT filename=*-*_*.pdf
| eval Actual=case(filename="S...
...s formatted in proper json "tree" view and color coding in Search. Ansible app uses the _json source type. When I tried to use . ...| eval foo = json_extract(<objectname>) | table foo I...