<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Syntax for if conditional functions in Alerting</title>
    <link>https://community.splunk.com/t5/Alerting/Syntax-for-if-conditional-functions/m-p/574720#M13222</link>
    <description>&lt;LI-CODE lang="markup"&gt;| eval SLA_Breach=if(ABC&amp;gt;3600, strftime(strptime(releaseToCarsTime, "%Y-%m-%d %H:%M:%S.%6N") +21600, "%Y-%m-%d %H:%M:%S.%6N"), if(DEF&amp;gt;2800,strftime(strptime(releaseToCarsTime, "%Y-%m-%d %H:%M:%S.%6N") +172800, "%Y-%m-%d %H:%M:%S.%6N"), if(GHI&amp;gt;1400,strftime(strptime(releaseToCarsTime, "%Y-%m-%d %H:%M:%S.%6N") +86400, "%Y-%m-%d %H:%M:%S.%6N"),"none")))&lt;/LI-CODE&gt;</description>
    <pubDate>Fri, 12 Nov 2021 09:28:37 GMT</pubDate>
    <dc:creator>ITWhisperer</dc:creator>
    <dc:date>2021-11-12T09:28:37Z</dc:date>
    <item>
      <title>Syntax for if conditional functions</title>
      <link>https://community.splunk.com/t5/Alerting/Syntax-for-if-conditional-functions/m-p/574684#M13221</link>
      <description>&lt;P&gt;Hello There,&lt;/P&gt;&lt;P&gt;I'm a bit rusty when it comes to the syntax and I am trying to get a better grasp. I have an if else function, so if lets say ABC is greater than 3600 add 21600 seconds else don't add any time. I have 3 of these types of conditions, but they are all under the same field name. The struggle for me is combining these if else functions into &lt;STRONG&gt;one&lt;/STRONG&gt; multi conditional function.&amp;nbsp; I have spent a while looking at how to do this, but I didn't run into any examples that included strftime or strptime.&amp;nbsp;&amp;nbsp;Any guidance on this type of syntax is apricated.&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval SLA_Breach=case(ABC&amp;gt;3600, strftime(strptime(releaseToCarsTime, "%Y-%m-%d %H:%M:%S.%6N") +21600, "%Y-%m-%d %H:%M:%S.%6N"),"none")

| eval SLA_Breach=if(DEF&amp;gt;2800,strftime(strptime(releaseToCarsTime, "%Y-%m-%d %H:%M:%S.%6N") +172800, "%Y-%m-%d %H:%M:%S.%6N"),"none")

| eval SLA_Breach=if(GHI&amp;gt;1400,strftime(strptime(releaseToCarsTime, "%Y-%m-%d %H:%M:%S.%6N") +86400, "%Y-%m-%d %H:%M:%S.%6N"),"none")&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 12 Nov 2021 04:49:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Syntax-for-if-conditional-functions/m-p/574684#M13221</guid>
      <dc:creator>MeMilo09</dc:creator>
      <dc:date>2021-11-12T04:49:39Z</dc:date>
    </item>
    <item>
      <title>Re: Syntax for if conditional functions</title>
      <link>https://community.splunk.com/t5/Alerting/Syntax-for-if-conditional-functions/m-p/574720#M13222</link>
      <description>&lt;LI-CODE lang="markup"&gt;| eval SLA_Breach=if(ABC&amp;gt;3600, strftime(strptime(releaseToCarsTime, "%Y-%m-%d %H:%M:%S.%6N") +21600, "%Y-%m-%d %H:%M:%S.%6N"), if(DEF&amp;gt;2800,strftime(strptime(releaseToCarsTime, "%Y-%m-%d %H:%M:%S.%6N") +172800, "%Y-%m-%d %H:%M:%S.%6N"), if(GHI&amp;gt;1400,strftime(strptime(releaseToCarsTime, "%Y-%m-%d %H:%M:%S.%6N") +86400, "%Y-%m-%d %H:%M:%S.%6N"),"none")))&lt;/LI-CODE&gt;</description>
      <pubDate>Fri, 12 Nov 2021 09:28:37 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Syntax-for-if-conditional-functions/m-p/574720#M13222</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-11-12T09:28:37Z</dc:date>
    </item>
    <item>
      <title>Re: Syntax for if conditional functions</title>
      <link>https://community.splunk.com/t5/Alerting/Syntax-for-if-conditional-functions/m-p/574798#M13225</link>
      <description>&lt;P&gt;Thanks!&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168"&gt;@ITWhisperer&lt;/a&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Sat, 13 Nov 2021 04:03:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Syntax-for-if-conditional-functions/m-p/574798#M13225</guid>
      <dc:creator>MeMilo09</dc:creator>
      <dc:date>2021-11-13T04:03:13Z</dc:date>
    </item>
  </channel>
</rss>

