https://community.splunk.com/t5/Splunk-Search/How-to-search-for-latest-case-output/m-p/490044#M136876 <P>If you are correct in your redaction (a <EM>big</EM> <CODE>if</CODE>; we could help better if you sent all the real <CODE>SPL</CODE>), then the problem must be in the <CODE>eval</CODE>. To test, add this as the last clause in your <CODE>case</CODE> statement: <CODE>true(), "DEBUG"</CODE>. You will see that <CODE>DEBUG</CODE> is returned. Therefore, fix your <CODE>case</CODE>. Also try running in <CODE>verbose</CODE> mode because some versions of Splunk have bugs in other modes.</P> Thu, 26 Sep 2019 21:02:36 GMT woodcock 2019-09-26T21:02:36Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-latest-case-output/m-p/490041#M136873 <P>My search looks something like this:</P> <PRE><CODE>index=name | eval request=case(X, Y, X, Y, X, Y) | stats latest(request) as Request | table Request </CODE></PRE> <P>Whenever I run this I am getting blank output. I really need to solve getting this to run or an alternative to providing the latest event that passed the case criteria.</P> <P>I have already tried doing this with nested if() statements as well instead of case, but no luck there either. </P> Wed, 25 Sep 2019 15:53:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-latest-case-output/m-p/490041#M136873 rlippincott 2019-09-25T15:53:49Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-latest-case-output/m-p/490042#M136874 <P>Have you verified the <CODE>eval</CODE> is working as expected? When you run <CODE>index=name | eval request=case(X, Y, X, Y, X, Y) | table request</CODE>do you see anything in the 'request' field?</P> Wed, 25 Sep 2019 18:29:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-latest-case-output/m-p/490042#M136874 richgalloway 2019-09-25T18:29:21Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-latest-case-output/m-p/490043#M136875 <P>I am getting nothing when doing that. My case is written like this more specifically:<BR /> eval response=case(name1==good AND name2==bad, "N1 good, N2 bad", ...)<BR /> I wasn't sure if using the == or = was correct, or if I could even use the AND in the parameter portion of the case function. The documentation isn't super clear and I have seen most of it used.</P> Thu, 26 Sep 2019 14:47:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-latest-case-output/m-p/490043#M136875 rlippincott 2019-09-26T14:47:14Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-latest-case-output/m-p/490044#M136876 <P>If you are correct in your redaction (a <EM>big</EM> <CODE>if</CODE>; we could help better if you sent all the real <CODE>SPL</CODE>), then the problem must be in the <CODE>eval</CODE>. To test, add this as the last clause in your <CODE>case</CODE> statement: <CODE>true(), "DEBUG"</CODE>. You will see that <CODE>DEBUG</CODE> is returned. Therefore, fix your <CODE>case</CODE>. Also try running in <CODE>verbose</CODE> mode because some versions of Splunk have bugs in other modes.</P> Thu, 26 Sep 2019 21:02:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-latest-case-output/m-p/490044#M136876 woodcock 2019-09-26T21:02:36Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-latest-case-output/m-p/490045#M136877 <P>If you get nothing in the 'request' field then there is something wrong with the <CODE>case</CODE> statement. Make sure all of the clauses are valid. You can use either <CODE>=</CODE> or <CODE>==</CODE>. <CODE>AND</CODE> can be used. Be sure to use a default clause at the end, something like <CODE>1==1, "oops"</CODE>.</P> Mon, 30 Sep 2019 13:11:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-latest-case-output/m-p/490045#M136877 richgalloway 2019-09-30T13:11:06Z