<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Conditional Nested If Statement in Reporting</title>
    <link>https://community.splunk.com/t5/Reporting/Conditional-Nested-If-Statement/m-p/533647#M8643</link>
    <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/226742"&gt;@Mary666&lt;/a&gt;,&lt;/P&gt;&lt;P&gt;"case" function seems to help you like below. I couldn't build a full query since the data inside RecordStage is not certain. If you can write a sample data and desired sample output, I can help better.&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval Reslut =case(RecordStage=0,"0",RecordStage=1,"Yes",1=1,"In Both Fields")&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Sat, 19 Dec 2020 12:21:12 GMT</pubDate>
    <dc:creator>scelikok</dc:creator>
    <dc:date>2020-12-19T12:21:12Z</dc:date>
    <item>
      <title>Conditional Nested If Statement</title>
      <link>https://community.splunk.com/t5/Reporting/Conditional-Nested-If-Statement/m-p/533627#M8641</link>
      <description>&lt;P&gt;Hello,&lt;/P&gt;&lt;P&gt;I have been reading all the blogs&amp;nbsp; around this subject, some questions I have had answered, but in this case I am not sure how to approach it.&amp;nbsp; Scenario:&amp;nbsp;&lt;/P&gt;&lt;P&gt;Three fields:&lt;/P&gt;&lt;P&gt;1. RecordStage, 2. pdfRecord 3. csvRecord&lt;BR /&gt;&lt;BR /&gt;&lt;EM&gt;The RecordStage is a field I have created that has all the values I need&lt;/EM&gt;. I just want to know the following:&lt;BR /&gt;&lt;BR /&gt;If RecordStage=0 display 0&lt;BR /&gt;&lt;BR /&gt;If RecoredStage&amp;gt;1 indicate if its logged in the pdfRecord&amp;nbsp; or in the csvRecord by indicating, Yes or No, All for being logged in both.&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;(index="xyz" ) OR (index="123"  ) 

| stats values(compGen) as compGen  values(levels) as levels count(eval(like(level,"RecordStage%"))) AS RecordStage values( Result) as  Result by TextDoc

| eval Reslut =if(RecordStage=0, "0"  AND (RecordStage=&amp;gt;1 AND RecordStage=pdfRecord OR RecordStage=csvRecord ), "Yes", "No", "In Both Fields"))&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 18 Dec 2020 23:12:06 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Conditional-Nested-If-Statement/m-p/533627#M8641</guid>
      <dc:creator>Mary666</dc:creator>
      <dc:date>2020-12-18T23:12:06Z</dc:date>
    </item>
    <item>
      <title>Re: Conditional Nested If Statement</title>
      <link>https://community.splunk.com/t5/Reporting/Conditional-Nested-If-Statement/m-p/533647#M8643</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/226742"&gt;@Mary666&lt;/a&gt;,&lt;/P&gt;&lt;P&gt;"case" function seems to help you like below. I couldn't build a full query since the data inside RecordStage is not certain. If you can write a sample data and desired sample output, I can help better.&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval Reslut =case(RecordStage=0,"0",RecordStage=1,"Yes",1=1,"In Both Fields")&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Sat, 19 Dec 2020 12:21:12 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Conditional-Nested-If-Statement/m-p/533647#M8643</guid>
      <dc:creator>scelikok</dc:creator>
      <dc:date>2020-12-19T12:21:12Z</dc:date>
    </item>
    <item>
      <title>Re: Conditional Nested If Statement</title>
      <link>https://community.splunk.com/t5/Reporting/Conditional-Nested-If-Statement/m-p/533663#M8644</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/206061"&gt;@scelikok&lt;/a&gt;&amp;nbsp; Thanks for your help. I really apricate your time. Here is my sample data.&amp;nbsp; I am having difficulty with my if statement, not sure if you would still recommend case. I re-wrote my query a bit. I would like to display:&lt;BR /&gt;&lt;BR /&gt;If PDF or CSV have a zero count for RecordStageX then = "NULL"&lt;BR /&gt;&lt;BR /&gt;If PDF&amp;gt;CSV = "No "&amp;nbsp; (This will tell me if RecordStageX is missing from wither PDF or CSV)&lt;BR /&gt;&lt;BR /&gt;If PDF=CSV = "Yes" (This will just meant that RecordStageX is being logged in both PDF or CSV)&lt;BR /&gt;&lt;BR /&gt;I cant seem to get my if statement to give me the desired Results:&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;| eval Testing =if(PDF="0" OR CSV="0", "Null", if(( PDF&amp;gt;CSV), "NO", if((PDF=CSV) "Yes"))))&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;(index="xyz" ) OR (index="123"  ) 

| eval PDF=case(level="RecordStageX", pdfRecord),  CSV=case(level="RecordStageX", csvRecord) 
| eval Testing =if(PDF="0" OR CSV="0", "Null", if(( PDF&amp;gt;CSV), "NO", if((PDF=CSV) "Yes"))))
| stats values(compGen) as compGen  values(levels) as levels count(eval(like(level,"RecordStageX%"))) AS RecordStage values( Tesing) as  Testing by TextDoc
&lt;/LI-CODE&gt;&lt;P&gt;&lt;BR /&gt;Desired output:&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;TABLE border="1" width="100%"&gt;&lt;TBODY&gt;&lt;TR&gt;&lt;TD width="20%" height="24px"&gt;TextDoc&lt;/TD&gt;&lt;TD width="20%" height="24px"&gt;CompGen&lt;/TD&gt;&lt;TD width="20%" height="24px"&gt;level&lt;/TD&gt;&lt;TD width="20%" height="24px"&gt;RecordStageX&lt;/TD&gt;&lt;TD width="20%" height="24px"&gt;Testing&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="20%" height="24px"&gt;TextDoc122&lt;/TD&gt;&lt;TD width="20%" height="24px"&gt;False&lt;/TD&gt;&lt;TD width="20%" height="24px"&gt;RecordStageX&lt;/TD&gt;&lt;TD width="20%" height="24px"&gt;20&lt;/TD&gt;&lt;TD width="20%" height="24px"&gt;No&lt;/TD&gt;&lt;/TR&gt;&lt;TR&gt;&lt;TD width="20%" height="24px"&gt;TextDoc123&lt;/TD&gt;&lt;TD width="20%" height="24px"&gt;True&lt;/TD&gt;&lt;TD width="20%" height="24px"&gt;RecordStageX&lt;/TD&gt;&lt;TD width="20%" height="24px"&gt;24&lt;/TD&gt;&lt;TD width="20%" height="24px"&gt;Yes&amp;nbsp;&lt;/TD&gt;&lt;/TR&gt;&lt;/TBODY&gt;&lt;/TABLE&gt;</description>
      <pubDate>Sun, 20 Dec 2020 06:44:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Conditional-Nested-If-Statement/m-p/533663#M8644</guid>
      <dc:creator>Mary666</dc:creator>
      <dc:date>2020-12-20T06:44:49Z</dc:date>
    </item>
    <item>
      <title>Re: Conditional Nested If Statement</title>
      <link>https://community.splunk.com/t5/Reporting/Conditional-Nested-If-Statement/m-p/533671#M8645</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/226742"&gt;@Mary666&lt;/a&gt;&amp;nbsp;, sorry, I am lost after first eval command, maybe because your anonymizations.&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval PDF=case(level="RecordStageX", pdfRecord),  CSV=case(level="RecordStageX", csvRecord)&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;Your is statements seems fine but the problem can be counting pdf and csv values.&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Sun, 20 Dec 2020 13:04:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Conditional-Nested-If-Statement/m-p/533671#M8645</guid>
      <dc:creator>scelikok</dc:creator>
      <dc:date>2020-12-20T13:04:39Z</dc:date>
    </item>
    <item>
      <title>Re: Conditional Nested If Statement</title>
      <link>https://community.splunk.com/t5/Reporting/Conditional-Nested-If-Statement/m-p/533677#M8646</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/206061"&gt;@scelikok&lt;/a&gt;&amp;nbsp; No worries, I'm sorry for the confusion. I was doing some more work on this and I think your first proposition for the solution may work.&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval Reslut =case(RecordStage=0,"0",RecordStage=1,"Yes",1=1,"In Both Fields")&lt;/LI-CODE&gt;&lt;P&gt;&lt;BR /&gt;The only question about the above query is that I dont see how its telling if RecordStage is being logged in either pdfRecord or csvRecord. I added the two fields below in the the index=123 pdfRecord=* ad csvRecord=*&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;But I would still like to know if:&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN&gt;If RecordStage=0 display 0&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN&gt;If RecoredStage&amp;gt;1 indicate if its logged in the pdfRecord&amp;nbsp; or in the csvRecord by indicating, Yes or No, All for being logged in both&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;STRONG&gt;&lt;EM&gt;At this point any direction you can point me to I would appreciate it. Thanks in advance.&amp;nbsp;&lt;/EM&gt;&lt;/STRONG&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;(index="xyz" ) OR (index="123" pdfRecord=* csvRecord=* ) 

| stats values(compGen) as compGen  values(levels) as levels count(eval(like(level,"RecordStage%"))) AS RecordStage values( Result) as  Result by TextDoc

| eval Reslut =case(RecordStage=0,"0",RecordStage=1,"Yes",1=1,"In Both Fields")&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Sun, 20 Dec 2020 19:07:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Conditional-Nested-If-Statement/m-p/533677#M8646</guid>
      <dc:creator>Mary666</dc:creator>
      <dc:date>2020-12-20T19:07:40Z</dc:date>
    </item>
  </channel>
</rss>

