topic Reassign (or keep) variable in eval's IF statement in Splunk Search

Reassign (or keep) variable in eval's IF statement

kevintelford — Fri, 29 Jul 2011 17:03:43 GMT

I have two variables and based on one would like to possible change the value of the other:

.. | eval a="foo" | eval b="some value" | eval a=if(match(b, "kittens"), "bar", a)

So if b contains 'kittens' make a's value equal 'bar', otherwise keep it 'foo'. Is this possible? As it stands now a only ever has a value when b contains 'kittens'.

Thanks,
Kevin

Re: Reassign (or keep) variable in eval's IF statement

fk319 — Fri, 29 Jul 2011 17:30:14 GMT

well it seems it should work, so I went to my code to see how I implemented it, I ended up using a case command with the last expression as 1==1.

 eval a=case(match(b, "kittens"), "bar", 1==1,a)

It seems that I had the same issue also, and this was how I was able to get it to work.

Re: Reassign (or keep) variable in eval's IF statement

kevintelford — Fri, 29 Jul 2011 17:51:21 GMT

Cool deal, too bad it doesn't work with if as well, but this will do just fine. Thanks!