Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How do I edit my "eval if match" syntax to evaluate complex combinations with precedence on the order of operation?

$
0
0
Hello all, I have the following eval function which functions properly: | eval my_count=if(match(lower(FieldName),"\\\filename.exe"),1,0) But I want to evaluate a few things in the if statement and need them to have precedence on the order of operation. What I'd like to be able to say is if FieldName contains `\filename.exe` OR (bob AND uncle) then 1, else 0, but for the life of me, I can't get the expected results. Any help is greatly appreciated.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>