Splunk Search

How to use a wildcard in an eval function?

kiran331
Builder

Hi

From the search, I get the field file_path. I have to differentiate the events based on the file path.
file_path= file:_C:\users........ and file=file:_D:\......., how to write eval function to differentiate this?

Search I'm using :

index=abc|eval title=if(file LIKE "C:\", "Normal", "USB or External Media")
Tags (2)
0 Karma
1 Solution

sundareshr
Legend

Try using match()

index=abc | eval title=if(match(x, "C:\\\\"), "Normal", "USB")

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

With you can use either LIKE function or match function to do regular exp based matching (and wild carding).

index=abc|eval title=if(like(file_path"C:\%"), "Normal", "USB or External Media")

index=abc|eval title=if(match(file_path,"^C:"), "Normal", "USB or External Media")
0 Karma

sundareshr
Legend

Try using match()

index=abc | eval title=if(match(x, "C:\\\\"), "Normal", "USB")
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...