https://community.splunk.com/t5/Splunk-Search/How-to-use-OR-boolean-in-an-eval-expression/m-p/368652#M108655 <P>Something in the spirit of - <CODE>| eval your_value=if(message="Event Description" OR name="Event Description", "xxxx"," all others")</CODE></P> Mon, 14 Aug 2017 13:41:19 GMT ddrillic 2017-08-14T13:41:19Z https://community.splunk.com/t5/Splunk-Search/How-to-use-OR-boolean-in-an-eval-expression/m-p/368651#M108654 <P>We're combining many types of searches into one tabled alert. We create our own variables with an eval statement and pass log variables into these. On certain versions of Windows these log variables have different names (message vs name). So we're wondering how to have an 'OR' statement depending on which name we're given. Thanks.</P> <P>For example, we have tried the following: </P> <PRE><CODE>.... | eval "Event Description"=Message, name | table ... "Event Description" .... | eval ("Event Description"=Message) OR ("Event Description"=name) | table ... "Event Description" .... | eval "Event Description"=(Message) OR (name) | table ... "Event Description" .... | eval "Event Description"=Message OR name | table ... "Event Description" </CODE></PRE> <P>None of these seem to work. They usually give us <STRONG>malform eval expression</STRONG> errors.</P> Mon, 14 Aug 2017 13:21:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-OR-boolean-in-an-eval-expression/m-p/368651#M108654 drizzo 2017-08-14T13:21:27Z https://community.splunk.com/t5/Splunk-Search/How-to-use-OR-boolean-in-an-eval-expression/m-p/368652#M108655 <P>Something in the spirit of - <CODE>| eval your_value=if(message="Event Description" OR name="Event Description", "xxxx"," all others")</CODE></P> Mon, 14 Aug 2017 13:41:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-OR-boolean-in-an-eval-expression/m-p/368652#M108655 ddrillic 2017-08-14T13:41:19Z https://community.splunk.com/t5/Splunk-Search/How-to-use-OR-boolean-in-an-eval-expression/m-p/368653#M108656 <PRE><CODE>| eval "Event Description"=coalesce(Message, name) </CODE></PRE> <P>The above will use <CODE>Message</CODE> if present, otherwise it will use <CODE>name</CODE> if present, and if neither are present the field will be null. Make sure the capitalization matches your system fields exactly.</P> Mon, 14 Aug 2017 14:11:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-OR-boolean-in-an-eval-expression/m-p/368653#M108656 DalJeanis 2017-08-14T14:11:27Z https://community.splunk.com/t5/Splunk-Search/How-to-use-OR-boolean-in-an-eval-expression/m-p/368654#M108657 <P>Beautiful thing !!!</P> Mon, 14 Aug 2017 14:15:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-OR-boolean-in-an-eval-expression/m-p/368654#M108657 ddrillic 2017-08-14T14:15:16Z https://community.splunk.com/t5/Splunk-Search/How-to-use-OR-boolean-in-an-eval-expression/m-p/368655#M108658 <P>This is more than what I was expecting. Thank you very much! Works very well.</P> Tue, 15 Aug 2017 11:02:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-OR-boolean-in-an-eval-expression/m-p/368655#M108658 drizzo 2017-08-15T11:02:34Z