Splunk Search

help on eval command

jip31
Motivator

Hi
I dont know why my eval command doesnt return any resulys

 `index` 
| lookup tutu.csv HOSTNAME as host output SITE 
| stats values(SITE) as Site, values(index) AS index  BY host 
| eval check=if(index="ai-toto*" ,"toto index only","All indexes") 
| search check="toto index only" 
| table host 

If I delete the eval comamnd I have results
I have done a workaround like this:

| stats values(SITE) as Site, dc(index) AS index BY host 
| where NOT index==4

It works but I would like to know why my original search doesnt works

Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
  `index` 
 | lookup tutu.csv HOSTNAME as host output SITE 
 | stats values(SITE) as Site, values(index) AS index  BY host 
 | eval check=if(index="ai-toto*" ,"toto index only","All indexes") 
 | search check="toto index only" 
 | table host 

this query's index is multivalue.
so | eval check=if(index="ai-toto*" ,"toto index only","All indexes") is not work.

View solution in original post

0 Karma

to4kawa
Ultra Champion
  `index` 
 | lookup tutu.csv HOSTNAME as host output SITE 
 | stats values(SITE) as Site, values(index) AS index  BY host 
 | eval check=if(index="ai-toto*" ,"toto index only","All indexes") 
 | search check="toto index only" 
 | table host 

this query's index is multivalue.
so | eval check=if(index="ai-toto*" ,"toto index only","All indexes") is not work.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

try this:

`index` | lookup tutu.csv HOSTNAME as host output SITE | stats values(SITE) as Site, values(index) AS index BY host | mvexpand index | eval check=if(match(index,"ai-toto*") ,"toto index only","All indexes") | search check="toto index only" | dedup host | table host
0 Karma

jip31
Motivator

thanks its ok

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...