topic How don't we nullify the data? in Splunk Search

How don't we nullify the data?

danielbb — Wed, 21 Aug 2019 15:28:39 GMT

A developer here wrote the following -

|eval admin_activity=if((like(cmd_data, "%audit%") AND like(cmd_data, "%start=%") AND NOT like(cmd_data, "%end=%")), "Login Attempt", NULL)
|eval admin_activity=if((like(cmd_data, "%audit%") AND like(cmd_data, "%start=%") AND like(cmd_data, "%end=%") AND isnull(admin_activity)), "Login Success", NULL)
|eval admin_activity=if((like(cmd_data, "%transaction%") AND isnull(admin_activity)), "Config Change", NULL)

We end up having admin_activity only as Config Change because the last eval nullifies the findings from the above two evals.

What can we do here?

Re: How don't we nullify the data?

somesoni2 — Wed, 21 Aug 2019 15:41:32 GMT

Merge them in single eval-case , like this, so it stops overwriting value of admin_activity after first condition is true.

|eval admin_activity=case((like(cmd_data, "%audit%") AND like(cmd_data, "%start=%") AND NOT like(cmd_data, "%end=%")), "Login Attempt", (like(cmd_data, "%audit%") AND like(cmd_data, "%start=%") AND like(cmd_data, "%end=%") AND isnull(admin_activity)), "Login Success", (like(cmd_data, "%transaction%") AND isnull(admin_activity)), "Config Change", true(), null())

Re: How don't we nullify the data?

Sukisen1981 — Wed, 21 Aug 2019 15:45:01 GMT

hi @danielbb
You need to use a single eval

   |eval admin_activity=if((like(cmd_data, "%audit%") AND like(cmd_data, "%start=%") AND NOT like(cmd_data, "%end=%")), "Login Attempt", if((like(cmd_data, "%audit%") AND like(cmd_data, "%start=%") AND like(cmd_data, "%end=%") AND isnull(admin_activity)), "Login Success",if((like(cmd_data, "%transaction%") AND isnull(admin_activity)), "Config Change", NULL)))