https://community.splunk.com/t5/Splunk-Dev/If-statement-with-multiple-tests/m-p/31301#M366 <P>Please comment when voting down an answer. My answer is perfectly valid.</P> Tue, 25 Jan 2011 14:23:03 GMT araitz 2011-01-25T14:23:03Z https://community.splunk.com/t5/Splunk-Dev/If-statement-with-multiple-tests/m-p/31298#M363 <P>Is it possible to do something like this? It would make my life a whole lot easier if this can be done, or at least something like it...</P> <PRE><CODE>eval if(((TimeTaken&gt;15) AND ((Termination_Cause=="016") OR (Termination_Cause=="017"))),1,0) </CODE></PRE> <P>When I try it I get an error stating that the expression is malformed. Any advice is appreciated.</P> Tue, 25 Jan 2011 08:49:41 GMT https://community.splunk.com/t5/Splunk-Dev/If-statement-with-multiple-tests/m-p/31298#M363 msarro 2011-01-25T08:49:41Z https://community.splunk.com/t5/Splunk-Dev/If-statement-with-multiple-tests/m-p/31299#M364 <P>You're not far off <BR /> <BR /> eval <B>foo=</B>if((TimeTaken&gt;15) AND (Termination_Cause=="016" OR Termination_Cause=="017"),1,0)</P> Tue, 25 Jan 2011 09:03:32 GMT https://community.splunk.com/t5/Splunk-Dev/If-statement-with-multiple-tests/m-p/31299#M364 ayme 2011-01-25T09:03:32Z https://community.splunk.com/t5/Splunk-Dev/If-statement-with-multiple-tests/m-p/31300#M365 <P>You should probably post your whole search, there are might be some extra parenthesis in there.</P> <P>Note that eval takes the form:</P> <PRE><CODE>eval &lt;my_field&gt; = &lt;my_eval_expression&gt; </CODE></PRE> <P>Also, I think you can use searchmatch() here more efficiently:</P> <PRE><CODE>eval case=searchmatch("TimeTaken&gt;15 AND (Termination_Cause="16" OR Termination_Cause="17")") </CODE></PRE> <P>If case=true, then the event matches the condition.</P> Tue, 25 Jan 2011 09:06:19 GMT https://community.splunk.com/t5/Splunk-Dev/If-statement-with-multiple-tests/m-p/31300#M365 araitz 2011-01-25T09:06:19Z https://community.splunk.com/t5/Splunk-Dev/If-statement-with-multiple-tests/m-p/31301#M366 <P>Please comment when voting down an answer. My answer is perfectly valid.</P> Tue, 25 Jan 2011 14:23:03 GMT https://community.splunk.com/t5/Splunk-Dev/If-statement-with-multiple-tests/m-p/31301#M366 araitz 2011-01-25T14:23:03Z https://community.splunk.com/t5/Splunk-Dev/If-statement-with-multiple-tests/m-p/31302#M367 <P>This worked, thanks!</P> Wed, 02 Feb 2011 04:16:58 GMT https://community.splunk.com/t5/Splunk-Dev/If-statement-with-multiple-tests/m-p/31302#M367 msarro 2011-02-02T04:16:58Z