Hi @bluewizard
Something like this would work.
|makeresults
| eval url="abc-jjjj-j-xyz.exmaple.come"
,s1=if(match(url, "abc"), 1, 0) ``` regex ```
,s2=if(match(url, "efg"), 1, 0)
,s3=if(like(url, "%xyz%"), 1, 0) ``` more SQL like ```
,s4=if(searchmatch("url=*jjjj*"), 1, 0) ``` probably the least efficient method depending on the base seach ```
| addtotals label=s* fieldname="symbol_count"
| where symbol_count>2
As the original question has been answered you should make this answer as solution provided.
Karma would also be appreciated too.
Hope that helps
Hi @bluewizard
Here is a run anywhere example showing a few different methods you could use...
|makeresults
| eval url="abc-jjjj-j-xyz.exmaple.come"
,s1=if(match(url, "abc"), "true", "false") ``` regex ```
,s2=if(match(url, "efg"), "true", "false")
,s3=if(like(url, "%xyz%"), "true", "false") ``` more SQL like ```
,s4=if(searchmatch("url=*jjjj*"), "true", "false") ``` probably the least efficient method depending on the base seach ```
Here's the latest Splunk docs on eval functions, too.
https://docs.splunk.com/Documentation/Splunk/9.0.4/SearchReference/CommonEvalFunctions#Alphabetical_...
Hope that helps
i have tried the sql like method
how do i do something like if two or more of ( s1,s2,s3 ) in URL, and count of symbol > 2 in url?
Hi @bluewizard
Something like this would work.
|makeresults
| eval url="abc-jjjj-j-xyz.exmaple.come"
,s1=if(match(url, "abc"), 1, 0) ``` regex ```
,s2=if(match(url, "efg"), 1, 0)
,s3=if(like(url, "%xyz%"), 1, 0) ``` more SQL like ```
,s4=if(searchmatch("url=*jjjj*"), 1, 0) ``` probably the least efficient method depending on the base seach ```
| addtotals label=s* fieldname="symbol_count"
| where symbol_count>2
As the original question has been answered you should make this answer as solution provided.
Karma would also be appreciated too.
Hope that helps