topic How to create a condition statement in Splunk Search

How to create a condition statement

dkdeepshikhaa — Fri, 07 Jun 2019 13:15:56 GMT

Is there a possibility in Splunk to get data like below :

If a condition is true then that data is to be printed in table 

If (a $lt; b)

eval c=round(((b-a)/b)*100),0)

print c (in table format)

Or else just a message on full screen that with "no change".

Re: How to create a condition statement

Vijeta — Fri, 07 Jun 2019 13:52:00 GMT

@dkdeepshikhaa if there are multiple events in your query your conditional evaluation will be based on each event. You can get no change text in table with below query-

<your search>| eval var=round(((b-a)/b)*100),0) | eval c = if(a<b,var,"no change") | table c

Re: How to create a condition statement

vnravikumar — Fri, 07 Jun 2019 15:58:36 GMT

Looks duplicate of

https://answers.splunk.com/answers/751381/if-else-with-where-clause.html#answer-750800