topic Condition in Getting Data In

Condition

Khuzair81 — Fri, 28 May 2021 12:49:07 GMT

c1 = US, c2 = UAE

L1 = English, L2 = Arabic

I want to get the answer in "ans" like,

If c1= US,

then ans= L1

elseif c2 = UAE,

then ans= L2

Re: Condition

richgalloway — Fri, 28 May 2021 13:09:57 GMT

Splunk supports conditions using the if and case functions. RTM at https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/ConditionalFunctions

Some examples, using a modification of the example logic (which will never execute the else clause):

| eval ans=if(c="US", "English","Arabic") | eval ans=case(c="US", "English", c="UAE", "Arabic", 1==1, "Other") | eval L1="English", L2="Arabic" | eval ans=case(c="US", L1, c="UAE", L2, 1==1, "Other")

Re: Condition

Khuzair81 — Fri, 28 May 2021 18:21:12 GMT

@richgalloway

Please help in the below Query

c=US, UAE

Lang=English, Arabic

........... | rex fields=Lang "(? <myval>)"

| eval ans=case(c="US",myval) | table ans, myval

I'm getting the 'ans' field as blank while 'myval' field has the Value.

Re: Condition

richgalloway — Fri, 28 May 2021 19:08:43 GMT

The 'ans' field is blank because the 'c' field value is not "US". If none of the expressions in a case function evaluate to true then the result is NULL. That is why it's good practice to ensure the last expression always is true by using "1==1" or "true()".

Re: Condition

Khuzair81 — Sat, 29 May 2021 07:05:38 GMT

@richgalloway

c= US

Language = abcdENGLISH123qw

..... | rex fields=Language "\w{4}(?<myval>)\d{4}"

| eval ans=case(c="US",myval, true(), "NA" ) | table ans, myval, c

Result

ans = NA

myval = English

c = US

I want the ans = English

Re: Condition

kamlesh_vaghela — Sat, 29 May 2021 08:02:13 GMT

@Khuzair81

Can you please try this?

YOUR_SEARCH | eval c=split(c,","), Lang=split(Lang,",") | eval Ans = mvindex(Lang,mvfind(c,"US")) | table Ans

Here "US" is the value what I want to get Lang.

My Sample Search :

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.