topic Re: Using Eval statement in Splunk Search

Using Eval statement

Splunk_rocks — Mon, 23 Apr 2018 19:19:50 GMT

Hello Splunkers,
I have case field with below information so i need to construct Eval field.

case**

XYZ
2
0
3
yzr

Now i have to construct eval field like

If case=string then print case as it was in case field
case=2 then print " error code 2"
case =3 the print " error code 3"
case=0 then " error zero "

Re: Using Eval statement

ssadanala1 — Mon, 23 Apr 2018 19:32:27 GMT

Try this

| makeresults
| eval temp="XYZ,2,0,3,yzr"
| eval temp = split(temp,",")
| mvexpand temp
| eval status = case (temp=2 ,"error code 2 ", temp=3 ,"errorcode 3",temp = 0 , "error code 0",if(isstr(temp),"yes","no")=="yes" ,temp)

Re: Using Eval statement

Splunk_rocks — Mon, 23 Apr 2018 19:42:41 GMT

Thanks but that will not fulfill my req i need add Eval field to props file based on output.

Re: Using Eval statement

ssadanala1 — Mon, 23 Apr 2018 19:49:52 GMT

You can use this in caluclated fields in props.conf by specifying like this

EVAL-status = case (temp=2 ,"error code 2 ", temp=3 ,"errorcode 3",temp = 0 , "error code 0",if(isstr(temp),"yes","no")=="yes" ,temp)

Re: Using Eval statement

somesoni2 — Mon, 23 Apr 2018 19:57:07 GMT

Minor cosmetic correction:

EVAL-status = case (temp=2 ,"error code 2 ", temp=3 ,"errorcode 3",temp = 0 , "error code 0",isstr(temp), ,temp)

Re: Using Eval statement

Splunk_rocks — Mon, 23 Apr 2018 20:14:32 GMT

Thanks somesoni & ssadanala1 it worked for me now.