Splunk Search

Like function overview?

jassikul
Explorer

I am new to Splunk, Can someone please explain me what below query is doing and what does 1 mean at the end of Sourcetype and LIke and what 1=1.
Thanks in advance

| eval UseInSummary=case(
sourcetype="HTTP-RESULTS" AND Status="SUCCESS" AND Protocol="HTTP",1,

              like(Type,"packet_%") AND ResultCalculated=1,1,
              like(Type,"seeder_%") AND ResultCalculated=1 AND Result<200,1,
              Type="latent" AND ResultCalculated=1 AND Result<1000,1,
              1=1,0
            )       
Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

The 1==1 is a simple way to generate a boolean value of true. The fully proper way to do this is to use true() which is much more clear. The reason that it is there is because it is a best-practice use of case to have a "catch-all" condition at the end, much like the default condition does in most programming languages that have a case command. The like command uses SQL syntax to generate a boolean ( true or a false ). So this saying: "assign "1" to UseInSummary whenever Type starts with the string packet_ AND ResultCalculated is 1 (that's just one line). So you do all the "positive" cases and then default 'UseInSummaryto0` otherwise. Proper spacing and linebreaking helps to provide clarity in Splunk; try this:

| eval UseInSummary=case(
       (sourcetype="HTTP-RESULTS" AND Status="SUCCESS" AND Protocol="HTTP"), 1,
       (like(Type,"packet_%") AND ResultCalculated=1),                       1,
       (like(Type,"seeder_%") AND ResultCalculated=1 AND Result<200),        1,
       (Type="latent" AND ResultCalculated=1 AND Result<1000),               1,
       true(),                                                               0)

View solution in original post

woodcock
Esteemed Legend

The 1==1 is a simple way to generate a boolean value of true. The fully proper way to do this is to use true() which is much more clear. The reason that it is there is because it is a best-practice use of case to have a "catch-all" condition at the end, much like the default condition does in most programming languages that have a case command. The like command uses SQL syntax to generate a boolean ( true or a false ). So this saying: "assign "1" to UseInSummary whenever Type starts with the string packet_ AND ResultCalculated is 1 (that's just one line). So you do all the "positive" cases and then default 'UseInSummaryto0` otherwise. Proper spacing and linebreaking helps to provide clarity in Splunk; try this:

| eval UseInSummary=case(
       (sourcetype="HTTP-RESULTS" AND Status="SUCCESS" AND Protocol="HTTP"), 1,
       (like(Type,"packet_%") AND ResultCalculated=1),                       1,
       (like(Type,"seeder_%") AND ResultCalculated=1 AND Result<200),        1,
       (Type="latent" AND ResultCalculated=1 AND Result<1000),               1,
       true(),                                                               0)

jassikul
Explorer

Thanks Woodcock, much appreciated your detailed response.

Thanks

lfedak_splunk
Splunk Employee
Splunk Employee
0 Karma

jassikul
Explorer

Figured out, it assigns value as 1 and 1=1, 0 Rest everything else is 0.

Thanks

0 Karma

jassikul
Explorer

Thanks Ifedak,

Does 1 means, Its creating a new column and assigning value 1 to matching conditions or like conditions.

Thanks

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!