topic How to use If and Not statement in one pass? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-use-If-and-Not-statement-in-one-pass/m-p/414681#M119442 <P>Hello all,</P> <P>What's the best way to use a NOT statement in an if statement. I'm trying to accomplish something similar to the below. </P> <PRE><CODE>| eval x_height=if(isnull(x_height) AND NOT (sourcetype=mysourcetypeHere),"Not Defined",x_height) </CODE></PRE> Fri, 29 Jun 2018 23:08:02 GMT splunker1981 2018-06-29T23:08:02Z How to use If and Not statement in one pass? https://community.splunk.com/t5/Splunk-Search/How-to-use-If-and-Not-statement-in-one-pass/m-p/414681#M119442 <P>Hello all,</P> <P>What's the best way to use a NOT statement in an if statement. I'm trying to accomplish something similar to the below. </P> <PRE><CODE>| eval x_height=if(isnull(x_height) AND NOT (sourcetype=mysourcetypeHere),"Not Defined",x_height) </CODE></PRE> Fri, 29 Jun 2018 23:08:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-If-and-Not-statement-in-one-pass/m-p/414681#M119442 splunker1981 2018-06-29T23:08:02Z Re: How to use If and Not statement in one pass? https://community.splunk.com/t5/Splunk-Search/How-to-use-If-and-Not-statement-in-one-pass/m-p/414682#M119443 <P>This is more clear:</P> <PRE><CODE>| eval x_height=if((sourcetype=="mysourcetypeHere"), null(), coalesce(x_height, "Not Defined")) </CODE></PRE> Sat, 30 Jun 2018 02:28:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-If-and-Not-statement-in-one-pass/m-p/414682#M119443 woodcock 2018-06-30T02:28:17Z Re: How to use If and Not statement in one pass? https://community.splunk.com/t5/Splunk-Search/How-to-use-If-and-Not-statement-in-one-pass/m-p/414683#M119444 <P>That worked, thanks!</P> Sat, 30 Jun 2018 04:37:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-If-and-Not-statement-in-one-pass/m-p/414683#M119444 splunker1981 2018-06-30T04:37:12Z