Splunk Search

case command

DataOrg
Builder

i want case command to match case where abc = hhh and after word should be same as present as it is
abc
abc
efg
ffh

0 Karma
1 Solution

niketn
Legend

[Updated Answer]
With exact match and run anywhere search query

Ok then you need the following to be added to your existing search

| makeresults
| eval type="abc,xyzabc,abcdef,xyzabcdef"
| makemv type delim="," 
| mvexpand type
| replace "abc" with "123" in type

Or else

| makeresults
| eval type="abc,xyzabc,abcdef,xyzabcdef"
| makemv type delim="," 
| mvexpand type
| eval type=replace(type,"^abc$","123")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

[Updated Answer]
With exact match and run anywhere search query

Ok then you need the following to be added to your existing search

| makeresults
| eval type="abc,xyzabc,abcdef,xyzabcdef"
| makemv type delim="," 
| mvexpand type
| replace "abc" with "123" in type

Or else

| makeresults
| eval type="abc,xyzabc,abcdef,xyzabcdef"
| makemv type delim="," 
| mvexpand type
| eval type=replace(type,"^abc$","123")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

DataOrg
Builder

| eval type=replace(type,"abc","123")

this condition replaces all the pattern with abc. i want only with exact match "abc".

for example if fields value with "abcefg" it matches and getting replaced with 123

0 Karma

niketn
Legend

So try this

| eval type=replace(type,"^abc$","123")

You can also try as per previous comment.

| replace "abc" with "123" in type
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@premranjithj, your question is not clear, please elaborate and add as much information as possible. What is the data you have (mock/dummy) along with field name? Also what is the query you have tried so far?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

DataOrg
Builder

i have list of fields
1.abc
2.bbc
3.abc
4.ggh
5.usb

if i a field has value abc its should be replaced with 123. other fields can have the data as it is.

0 Karma

niketn
Legend

Is the field name abc or the value of the field abc? If it is second case what is the field name?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

DataOrg
Builder

field name type and value is abc

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...