topic Re: Eval Case Formula in Splunk Search

Eval Case Formula

jackreeves — Tue, 29 Sep 2020 15:18:20 GMT

Hi,

Struggling to complete an Eval Case syntax. I want to create a situation where I have a new field called provider based on certain criteria.

Provider:
XYZ (if D1_Code equals X and current team does not equal ABC or DEF)
ABC (if current team equals ABC) - wildcards needed as there are variants of ABC
DEF (if current team equals DEF) - wildcards needed as there are variants of DEF

Search string is | eval Provider=case(D1_Code="X" AND Current_Team!="ABC" AND Current_Team!="DEF", "XYZ", Current_Team="ABC", "ABC", Current_Team="DEF", "DEF")

The first part of the eval works on it's own but when I try and add criteria for ABC and DEF it will not work.
Provider=case(D1_Code="X" AND Current_Team!="ABC" AND Current_Team!="DEF")

Could anyone please advice? Not sure if case is the right thing to use here.

Thanks in advance

Re: Eval Case Formula

adonio — Thu, 10 Aug 2017 17:58:44 GMT

great answer here:
https://answers.splunk.com/answers/170602/how-would-i-use-eval-with-a-wildcard-to-create-a-c.html

Re: Eval Case Formula

somesoni2 — Thu, 10 Aug 2017 18:03:06 GMT

How about you change the order, like this...

....| eval Provider=case(Current_Team="ABC", "ABC", Current_Team="DEF", "DEF",D1_Code="X", "XYZ")

Also, if you want to match with wildcards (you need to provide actual sample values for better suggestions), try this

....| eval Provider=case(match(Current_Team,"ABC"), "ABC", match(Current_Team,"DEF"), "DEF",D1_Code="X", "XYZ")

Re: Eval Case Formula

s2_splunk — Thu, 10 Aug 2017 18:04:19 GMT

This works for me: | makeresults | eval D1_Code="X", Current_Team="DEF" | eval Provider=case( (D1_Code="X" AND Current_Team!="ABC" AND Current_Team!="DEF"), "XYZ", Current_Team="ABC", "ABC", Current_Team="DEF", "DEF")

Re: Eval Case Formula

jackreeves — Fri, 11 Aug 2017 08:14:22 GMT

Brilliant - this solved the issue!

Many thanks

Re: Eval Case Formula

adonio — Fri, 11 Aug 2017 13:07:54 GMT

converted to answer, if it worked for you, please accept it and mark as answered