topic Re: How do I do a nested if statement? in Splunk Dev

How do I do a nested if statement?

jitin_ratra — Tue, 16 Oct 2018 14:14:44 GMT

I am trying to use multiple ifs within the eval but the query seems to throw an error.

What i want to do is use TTI if it's greater than 0. Otherwise, I'd use TTIVR if FCP!=0

This is what i tried so far
| eval test=if( TTI > 0, TTI, if(FCP!=0,TTIVR))

Vijeta — Tue, 16 Oct 2018 14:43:48 GMT

Use this code , as you need to specify the value if FCP!=0 condition is false therefore I have placed null( can be any other value like " ")

|eval test=if(TTI > 0, TTI,if(FCP!=0,TTIVR,null))

kamlesh_vaghela — Tue, 16 Oct 2018 16:09:56 GMT

@jitin_ratra

You can try case also.

YOUR_SEARCH
| eval test=case( TTI>0, TTI, FCP!=0,TTIVR)

Sample Search:

| makeresults 
| eval TTI=100,FCP=0,TTIVR =100
| eval test=case( TTI>0, TTI, FCP!=0,TTIVR)