eval if command with returned value = all from dropdown list

[krusovice]

Hello all,

I'm forming the eval query based on the value extracted from dropdown token.

| eval city=if((_raw LIKE "%$city$%"),"$city$","0" )

Issue here is that the dropdown is having All=* configured. If user chosen "All" from the dropdown list, the "city" token will be equal to 0, which is not correct.

How can I pass all the "city" value to the next query if All is selected?

[mayurr98 · Accepted solution]

why do not you just try city="$city$" to pass the city value?

[krusovice]

No it is not working. city token is from dropdown list. There is no such field "city=" in the log. My simplified query as below:

index=* "Country: $clicked_country$ - CITY: $city$" 
| eval country=if((_raw LIKE "%$clicked_country$%"),"$clicked_country$","0")
| eval city=if((_raw LIKE "%$city$%"),"$city$","0")
| stats values(date_hour) as "Hour" by country city

[mayurr98]

why do not you extract city and country to make your job easier I see from the events they are in standard format.

| rex field=_raw "Country\:\s(?<country>[^\s]+)\s\-\sCity\:\s(?<city>[^\s]+)" | search city="$city$"

and then use * as a wildcard for ALL.

From your current search query you need to substitute * for the main search and % for the eval statement.

let me know if this helps!

[krusovice]

Yes it is working fine now after several tests. Thanks to @mayurr98 and @493669.

[deepashri_123]

Hey krusovice,

Is your city field already extracted?
If yes, then rather than writing eval you can try something like this:

index=* | search city=$city$ 

In this case, if you select all, city will be selected as city=* and that should help!!

Let me know if this worked!!

[krusovice]

hi @493669 and @deepashri,

Both solution not working. There is no "city=" to be matched in the log. the $city$ field is from dropdown list (e.g. All, London, Mancester....etc).

Solution provided by @493669 still returning as "*".

[493669]

In what scenario you are using $city$ token? if you could share what output you are expecting...

[krusovice]

Desired output in table format as explained in:

https://answers.splunk.com/answers/624710/formatting-output-in-table.html

[493669]

try this:

index=*|  rex field=_raw "Country\:\s(?<country>[^\s]+).*City\:\s(?<city>[^\s]+)"
| search city="$city$" AND country="$clicked_country$"
 | stats values(date_hour) as "Hour" by country city

[mayurr98]

how are you getting events from the dropdown list? is it coming from lookup? or you are extracting it at search time ?
it would be great if you share sample events and xml for your current dashboard.

[krusovice]

city token from dropdown list is extracted using regex to catch the "city" in the log.

Sample log:
Request_A - Country: GERMANY - City: BER

[493669]

why you wont try simply

 | eval city="$city$"