Eval Case Statement not working

lorellpascual — Tue, 29 Sep 2020 16:32:35 GMT

Not sure why the below is not working.

index=www_kinesis rtData.tag=pageviewTag | eval marketing_channel=case(rtData.referralUrl=="https://www.google.com/", "Natural Search", 1=1, "Direct Load") | table sessionId, marketing_channel, rtData.referralUrl

All I basically want is, if my rtData.referralUrl= https://www.google.com/ to output "Natural Search". For some reason I've done equals and I've tried even case match, and I'm still not returning "Natural Search", even though my referralUrl is clearly https://www.google.com/

Re: Eval Case Statement not working

somesoni2 — Wed, 01 Nov 2017 17:30:43 GMT

The field name you used in eval contains special characters (dot) so they need to be enclosed within single quotes (this is applicable for eval and where commands). Try this

index=www_kinesis rtData.tag=pageviewTag | eval marketing_channel=case('rtData.referralUrl'=="https://www.google.com/", "Natural Search", 1=1, "Direct Load") | table sessionId, marketing_channel, rtData.referralUrl

topic Eval Case Statement not working in Splunk Search

Eval Case Statement not working

Re: Eval Case Statement not working