topic Help on eval if from eval case in Splunk Enterprise

Help on eval if from eval case

jip31 — Thu, 23 Jun 2022 18:29:57 GMT

As you can see, I use a first eval in order to rename the field "site"

From the site renamed, I need to create a new field called "toto" in order to add new information for the field site.

So I create an eval if command like below but it doesn't work.

What is wrong please and is there another simple way to do this?

| eval site=case(site=="BR", "Espace Br", site=="PERI THEATRE", "Espace Périg", 1==1,site) | stats last(site) as "Espace BP" by s | eval toto=if("Espace BP"=="Espace Br", "4G") | table "Espace BPE" toto

Re: help on eval if from eval case

richgalloway — Wed, 22 Jun 2022 18:31:51 GMT

The if function is comparing two different strings and setting a value only if they are equal. Therefore, toto is always null.

Use single quotes around a field name containing spaces.

| eval site=case(site=="BR", "Espace Br", site=="PERI THEATRE", "Espace Périg", 1==1,site) | stats last(site) as "Espace BP" by s | eval toto=if('Espace BP'=="Espace Br", "4G") | table "Espace BPE" toto

Better yet, don't use spaces in field names at all. Add a final rename command in the query to make the names "pretty".