topic Re: Why does multiple eval statements cause only last to be run? in Splunk Search

Why does multiple eval statements cause only last to be run?

markhvesta — Mon, 15 Jul 2019 18:26:42 GMT

I am trying to create a low volume type of alert based on one sourcetype for multiple Channels that have very different amounts of traffic. The search I am using is as follows:

sourcetype="mytraffic"
| chart count as Count by Channel
| eval MeetThreshold?=if((Count<=4) AND (Channel=="Web"),"Fail","Pass")
| eval MeetThreshold?=if((Count<=400) AND (Channel=="Mobile"),"Fail","Pass")
| table Channel Count MeetThreshold?

In my tests, it seems the results only reflect the status of the last eval statement. Is there a better way to do this?

Re: Why does multiple eval statements cause only last to be run?

jkat54 — Mon, 15 Jul 2019 18:38:31 GMT

Thats because your defining the same field name. try this approach instead:

 sourcetype="mytraffic"
 | chart count as Count by Channel
 | eval MeetThreshold1=if((Count<=4) AND (Channel=="Web"),"Fail","Pass")
 | eval MeetThreshold2=if((Count<=400) AND (Channel=="Mobile"),"Fail","Pass")
 | eval MeetThreshold=coalesc(MeetThreshold1,MeetThreshold2)
 | table Channel Count MeetThreshold

Re: Why does multiple eval statements cause only last to be run?

jkat54 — Mon, 15 Jul 2019 18:41:26 GMT

Or you can make one long case / if:

  sourcetype="mytraffic"
  | chart count as Count by Channel
  | eval MeetThreshold=if((Count<=4 AND Channel=="Web"),"Fail",if((Count<=400 AND Channel=="Mobile"),"Fail","Pass")))
  | table Channel Count MeetThreshold

  sourcetype="mytraffic"
  | chart count as Count by Channel
  | eval MeetThreshold=case(
   Count<=4 AND Channel=="Web","Fail",
   Count<=400 AND Channel=="Mobile","Fail",
   1=1,"Pass")
  | table Channel Count MeetThreshold

Re: Why does multiple eval statements cause only last to be run?

woodcock — Mon, 15 Jul 2019 19:22:48 GMT

You need to use case like this:

sourcetype="mytraffic"
| chart count as Count by Channel
| eval MeetThreshold=case(
   (Count<=4) AND (Channel=="Web"), "Fail",
   (Count<=400) AND (Channel=="Mobile"), "Fail",
   true(), "Pass")
| table Channel Count MeetThreshold

Re: Why does multiple eval statements cause only last to be run?

markhvesta — Mon, 15 Jul 2019 20:57:56 GMT

That is perfect. Thank you