topic Re: Updating multiple value in same field using eval command in Security

How to update multiple value in same field using eval command?

Rajiv_splunk — Fri, 29 Jul 2022 15:39:54 GMT

HI Everyone,

I am trying to update multiple value in the same field using eval case command but it returning the below error

Error in 'eval' command: The expression is malformed. Expected ).

My requirement is to update when website is ABC the delievery_status should be on_the_way, and when website is xyz the delievery_status should be delievered else it should say Nt delievered. and i am writing the below case statement

| eval delievery_status = case (website="ABC" "on_the_way" website="xyz", "delievered", "Not_delievered")

Can anyone please help me on this what i am missing in this

Re: Updating multiple value in same field using eval command

DanielPriceUK — Fri, 29 Jul 2022 14:51:26 GMT

| eval delievery_status =
case (website="ABC","on_the_way",
website="xyz", "delievered",
True(),"Not_delievered")

Re: Updating multiple value in same field using eval command

Rajiv_splunk — Fri, 29 Jul 2022 14:55:23 GMT

Thanks a lot @DanielPriceUK . It works :)... Thanks for a quick reply

Re: Updating multiple value in same field using eval command

Rajiv_splunk — Fri, 29 Jul 2022 15:18:29 GMT

Thanks a lot @DanielPriceUK . It works :)... Thanks for a quick reply