https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-with-query/m-p/537589#M36748 <LI-CODE lang="markup">| eval Result=if(Node_State=="Running", "Ok", "NotOk") </LI-CODE> Thu, 28 Jan 2021 10:19:15 GMT to4kawa 2021-01-28T10:19:15Z https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-with-query/m-p/537586#M36747 <P>Hi,</P><P><SPAN>I am getting&nbsp; the below table using the query "index=main host="abcde" | rex field=_raw "(?ms)Node\s+Name\s:\s(?&lt;Node_Name&gt;\w+\S+)" | rex field=_raw "(?ms)Node\sState\s:\s(?&lt;Node_State&gt;[\w\s]+\w)\s+Number&nbsp;</SPAN><SPAN>| eval Result=if('Node_State'=='Running', "Ok", "NotOk") | table Node_Name,Node_State,Result"</SPAN></P><P><STRONG>Node_Name&nbsp; &nbsp; Node_State&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Result</STRONG></P><P>abc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Stopped&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;NotOk</P><P>cde&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Running&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NotOk</P><P>abc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Running&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NotOk</P><P>xyz&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Stopped&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;NotOk</P><P>the&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Running&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NotOk</P><P>abc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Partially running&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NotOk</P><P>abc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Stopped&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NotOk</P><P>xyz&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Running&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NotOk</P><P>the&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Running&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NotOk</P><P>abc&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Running&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NotOk</P><P>&nbsp;</P><P>Is there anything wrong with my query in the eval command..? I want the "Result" field to be "Ok" if Running and "NotOk" for any other state. But here it seems not working as expected.</P><P>Please help modify the query to get the output in desired way.</P><P>Thank you.</P> Thu, 28 Jan 2021 09:50:41 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-with-query/m-p/537586#M36747 Mrig342 2021-01-28T09:50:41Z https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-with-query/m-p/537589#M36748 <LI-CODE lang="markup">| eval Result=if(Node_State=="Running", "Ok", "NotOk") </LI-CODE> Thu, 28 Jan 2021 10:19:15 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-with-query/m-p/537589#M36748 to4kawa 2021-01-28T10:19:15Z https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-with-query/m-p/537596#M36751 <P>Hi&nbsp;<SPAN>to4kawa,</SPAN></P><P><SPAN>Thank you very much..!! It is now working as desired.</SPAN></P> Thu, 28 Jan 2021 10:46:18 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Need-help-with-query/m-p/537596#M36751 Mrig342 2021-01-28T10:46:18Z