Splunk Search

Eval with multiple values

jwalzerpitt
Influencer

I have three event types:

eventtype="windows_login_failed"
eventtype="duo_login_failed"
eventtype="sremote_login_failed"

I am trying to run a search in which I rename the event types to a common name:

Windows = eventtype="windows_login_failed"
DUO = eventtype="duo_login_failed"
Sremote = eventtype="sremote_login_failed"

I run the following search, but I keep getting an error message stating, 'Error in 'eval' command: The expression is malformed. Expected ).'

eventtype="windows_login_failed" OR eventtype="duo_login_failed" OR eventtype="sremote_login_failed" [| inputlookup xxx_xxx ] OR [| inputlookup yyy_yyy] | eval Source = (eventtype == windows_login_failed, "Windows"), (eventtype == sremote_login_failed, "SRemote"), (eventtype == duo_login_failed, "DUO") | stats count by myuser,Source| sort -count

Any help would be greatly appreciated

Thx

0 Karma
1 Solution

cmerriman
Super Champion

you'll need to make a case statement. try this

...| eval Source = case(eventtype == "windows_login_failed", "Windows", eventtype == "sremote_login_failed", "SRemote", eventtype == "duo_login_failed", "DUO")| ...

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Why you don't use a tag (e.g. Login_failed) assigned to th Three eventypes?
Bye.
Giuseppe

0 Karma

jwalzerpitt
Influencer

Excellent idea!

0 Karma

inventsekar
Ultra Champion

Please check this one -
eval Source=case(eventtype==windows_login_failed, "Windows", eventtype==sremote_login_failed, "SRemote", eventtype==duo_login_failed, "DUO")

eventtype="windows_login_failed" OR eventtype="duo_login_failed" OR eventtype="sremote_login_failed" [| inputlookup xxx_xxx ] OR [| inputlookup yyy_yyy] | eval Source=case(eventtype==windows_login_failed, "Windows", eventtype==sremote_login_failed, "SRemote", eventtype==duo_login_failed, "DUO") | stats count by myuser,Source| sort -count

jwalzerpitt
Influencer

Thx - that worked great. Appreciate the reply.

cmerriman
Super Champion

you'll need to make a case statement. try this

...| eval Source = case(eventtype == "windows_login_failed", "Windows", eventtype == "sremote_login_failed", "SRemote", eventtype == "duo_login_failed", "DUO")| ...

jwalzerpitt
Influencer

Thx - that worked great. Appreciate the reply.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...