topic Re: USE AND Operator in IF or CASE statement in Splunk Dev

USE AND Operator in IF or CASE statement

kumagaur — Thu, 24 Jan 2019 16:59:38 GMT

I have one lookup in which there is a field which consist
Team Member
A1
A2
A3
A4
A5
A6
A7
Now,If
TeamMember=(A1 OR A2) AND A4 AND A7 then print Aseries
TeamMember=(A1 OR A2) and A5 AND A6 then print Bseries

I tried |eval Team=if((con1=="A1 OR con1=A2)"AND con1=="A4" AND con1=A7,Aseries,Other)

I used case as well but no luck.

Re: USE AND Operator in IF or CASE statement

renjith_nair — Fri, 25 Jan 2019 04:48:33 GMT

@kumagaur ,
Do you have multiple values of con1 in a single event ? If not AND condition will not work. Do you have some sample events ?

Re: USE AND Operator in IF or CASE statement

vishaltaneja070 — Fri, 25 Jan 2019 06:44:13 GMT

Try this:
| eval Team= if((con1== "A1" OR con1=="A2") AND con1=="A4" AND con1="A7", Aseries, Other)

Re: USE AND Operator in IF or CASE statement

woodcock — Fri, 25 Jan 2019 22:37:49 GMT

Maybe like this:

Your Base Search Here
| appendpipe [|inputlookup TeamMember.csv | stats values(TeamMember) AS con1]
| eval Team=if(((con1=="A1" OR con1=="A2") AND con1=="A4" AND con1=="A7"), "Aseries", "Bseries")