<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Conditional statements with foreach in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-create-Conditional-statements-with-foreach/m-p/631789#M108274</link>
    <description>&lt;P&gt;Quote the &amp;lt;&amp;lt;MATCHSTR&amp;gt;&amp;gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| makeresults
| eval Perc_In_Range_4=100
| eval Perc_In_Range_4_to_6=11
| eval Perc_In_RANGE_4_to_6=22
| foreach Perc_In* [ eval Out_Of_Norm_For&amp;lt;&amp;lt;MATCHSTR&amp;gt;&amp;gt;=if(IN("&amp;lt;&amp;lt;MATCHSTR&amp;gt;&amp;gt;","_Range_4","_RANGE_4_to_6"),"Consider","Ignore") ]&lt;/LI-CODE&gt;&lt;P&gt;Note that the IN in eval will be case sensitive, i.e.&amp;nbsp;Perc_In_Range_4_to_6 will be "Ignore"&lt;/P&gt;</description>
    <pubDate>Wed, 22 Feb 2023 06:36:28 GMT</pubDate>
    <dc:creator>bowesmana</dc:creator>
    <dc:date>2023-02-22T06:36:28Z</dc:date>
    <item>
      <title>How to create Conditional statements with foreach?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-create-Conditional-statements-with-foreach/m-p/631786#M108273</link>
      <description>&lt;P&gt;Hi there -&amp;nbsp; trying to get foreach statement to apply conditional statement. Essentialy in the eval statement tried a variety of if with options like IN statements (or alternatively but less preferably a long OR to replace the IN statement )-&amp;nbsp; but frankly not having any luck.&lt;/P&gt;
&lt;PRE&gt;&amp;nbsp;foreach Perc_In* [ eval Out_Of_Norm_For&amp;lt;&amp;lt;MATCHSTR&amp;gt;&amp;gt;=if(IN(&amp;lt;&amp;lt;MATCHSTR&amp;gt;&amp;gt;,"_Range_4","_RANGE_4_to_6"),"Consider","Ignore") ]&amp;nbsp;&lt;/PRE&gt;
&lt;P&gt;If the &amp;lt;&amp;lt;matchstr&amp;gt;&amp;gt; falls in the set of values "_Range_4" or&amp;nbsp; "_RANGE_4to_6", then the new field&amp;nbsp;&amp;nbsp;Out_Of_Norm_For&amp;lt;&amp;lt;MATCHSTR&amp;gt;&amp;gt; should take a value of consider - else it takes a value of Ignore&lt;/P&gt;</description>
      <pubDate>Wed, 22 Feb 2023 17:04:58 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-create-Conditional-statements-with-foreach/m-p/631786#M108273</guid>
      <dc:creator>allanrm</dc:creator>
      <dc:date>2023-02-22T17:04:58Z</dc:date>
    </item>
    <item>
      <title>Re: Conditional statements with foreach</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-create-Conditional-statements-with-foreach/m-p/631789#M108274</link>
      <description>&lt;P&gt;Quote the &amp;lt;&amp;lt;MATCHSTR&amp;gt;&amp;gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| makeresults
| eval Perc_In_Range_4=100
| eval Perc_In_Range_4_to_6=11
| eval Perc_In_RANGE_4_to_6=22
| foreach Perc_In* [ eval Out_Of_Norm_For&amp;lt;&amp;lt;MATCHSTR&amp;gt;&amp;gt;=if(IN("&amp;lt;&amp;lt;MATCHSTR&amp;gt;&amp;gt;","_Range_4","_RANGE_4_to_6"),"Consider","Ignore") ]&lt;/LI-CODE&gt;&lt;P&gt;Note that the IN in eval will be case sensitive, i.e.&amp;nbsp;Perc_In_Range_4_to_6 will be "Ignore"&lt;/P&gt;</description>
      <pubDate>Wed, 22 Feb 2023 06:36:28 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-create-Conditional-statements-with-foreach/m-p/631789#M108274</guid>
      <dc:creator>bowesmana</dc:creator>
      <dc:date>2023-02-22T06:36:28Z</dc:date>
    </item>
  </channel>
</rss>

