Splunk Search
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question

Can i use 'match' within a case statement ?

rakesh_498115
Motivator
‎05-15-2013 04:43 AM

Hi

my expression

eval Server=case( match(series,"mul"), "MULT",match(series,"lfeg"), "LFEG",match(series,"EG"), "EG",match(series,"gateway"), "EG")

Can you pls help ???

How can i do this ?

Tags (1)
0 Karma
Reply

sdaniels
Splunk Employee
Splunk Employee
‎05-15-2013 05:36 AM

Yes, it seems like this approach can work for you. See this previous answer to make sure you've got structure correct.

http://splunk-base.splunk.com/answers/55524/eval-wildcards

0 Karma
Reply

rakesh_498115
Motivator
‎05-15-2013 04:47 AM

got that .typo mistake corrected it ..

0 Karma
Reply
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...