topic Re: If Statement with different fields in Reporting

If Statement with different fields

Mary666 — Sat, 12 Dec 2020 02:42:16 GMT

Hello Splunk Community,

I have not mastered complex if statements. I would like to know how I can get the following results:

1. If cookies are >=1 then output should be "Failure"

2. If cookies are < 0 then output should also be "Failure"

3. If cookies are = 0 AND if stage for this scenario is not ready, then output should be "In Progress"

Below is my logic for this query, but its not providing any results and its malformed, any help is appreciated.

| eval Bakes=if(cookies>="1", "Failure"), if (cookies<"0" "Failure"), if (cookies="0", "In Progress" AND Stages!="NotReady", "In Progress")

Re: If Statement with different fields

Mary666 — Sat, 12 Dec 2020 02:48:46 GMT

Just a correction, stage should not equal to ---> "NotReady" Therefore, the Stages!="NotReady"

Re: If Statement with different fields

to4kawa — Sat, 12 Dec 2020 10:26:18 GMT

| makeresults count=10 | eval cookies=(random() % 3) - 1, Stages=mvindex(split("NotReady,Ready",","),random() % 2) | eval Bakes=case(cookies >=1 OR cookies < 0, "Failure", cookies="0" AND Stages!="NotReady", "In Progress",true(), "Failure") | table cookies Stages Bakes

How about case?

Re: If Statement with different fields

nickhills — Sat, 12 Dec 2020 16:11:52 GMT

It seems to me that you can simplify your scenario a bit:

( cookies<0 AND cookies>=1) means: unless cookies is exactly 0 then its a failure.

If stage is "Not Ready" then your status is "In Progress"

Therefore there are only two conditions you need to test:

| eval Bakes=case(cookies!=0, "Failure", Stages="NotReady", "In Progress")

Re: If Statement with different fields

Mary666 — Fri, 18 Dec 2020 01:48:16 GMT

Thanks so much for your help, would you mind explaining to me the line of code below. I am not sure what the percentages mean, and what the " " supposed to be doing. I accepted your answer for the code right below it. If you can explain this to me that would be awesome.

| eval cookies=(random() % 3) - 1, Stages=mvindex(split("NotReady,Ready",","),random() % 2)

Re: If Statement with different fields

to4kawa — Sat, 19 Dec 2020 01:07:51 GMT

This is the part where the sample data is created.

% is modulo operator(https://en.wikipedia.org/wiki/Modulo_operation)

ref: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval#Operators

random() with % creates random "modulo numbers -1".

ref:

https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/StatisticalFunctions#random.28.29

so,

| eval cookies=(random() % 3) - 1

makes cookies -1, 0, 1.

random() % 2

makes 0 ,1.

so, Stages is "NotReady" or "Ready" randomly.