How to change a name within a field?

[happysplunkyay]

I have hundreds of .tmp files that begin with evb* and exist within the "File Name" field. All I want to do is change all of their names to EVB. I've tried match, eval, rename, banging my head against the wall, and staring at my screen wishing it to happen. I'm sure it's something simple, but i'm missing it.

eval file=case("File Name"="evbd*","EVB") 

Please help!

[niketn]

@happysplunkyay... Can you add some samples of filenames you have got? Do you have this filename as a field? if not you would need to provide a sample event. Also why you need to search for evbd and convert only EVB to upper case?

If your field containing file name is filename, then following should work:

<YourBaseSearch>  filename=CASE("evbd*")
| eval filename=replace(filename,"evb","EVB")

[puneethgowda]

Try replace commond!

[adonio]

try single commas, answer here:
https://answers.splunk.com/answers/54359/eval-function-on-a-column-that-has-spaces.html

eval file=case('File Name'="evbd*","EVB")

[happysplunkyay]

the single quotes is definitely something I had wrong. As somesoni2 below stated, it's the wildcard * that eval doesn't get along with...

thanks for your time.

[somesoni2]

The eval command doesn't support the wildcards that you use in base search. Instead use comparison functions e.g. like or match, like this. Also, in right side of eval/where, the field name should be enclosed in single quotes. With double quotes they are treated as literal string, not field:
Updated

eval file=case(like('File Name',"evbd%"),"EVB",'File Name') 

or

eval file=case(match('File Name',"evbd"),"EVB",'File Name') 

Also added default value for file should be same as "File Name" if it doesn't match your condition.

[happysplunkyay]

eval file=case(match('File Name',"evb*","EVB",'File Name')) |table file
gives me the error "Error in 'eval' command: The arguments to the 'match' function are invalid."

eval file=case(like('File Name',"evb*","EVB",'File Name')) |table file
just straight up says "The search job has failed due to an error."

I don't understand why it has to be this way - WHY OH WHY!?!?!?! 🙂

Thanks for your time, sir.

[somesoni2]

Silly me. Missed position of brackets. Try the updated answer now.

[happysplunkyay]

I would LOVE to say that did it, but the changing of the parenthetical position didn't do the trick. It seems like this would be so easy. Thanks again for your time.

|eval file=case(match('File Name',"evb*"),"EVB",'File Name') |table file
"Error in 'eval' command: The arguments to the 'case' function are invalid."

| eval file=case(like('File Name',"evb%"),"EVB",'File Name') |table file
"The search job has failed due to an error"