topic Re: Help in using CASE Statement in Splunk Search

Help in using CASE Statement

Noob_splunker — Sat, 04 Jul 2020 20:57:30 GMT

Hi there,

I want to group the filter into Full Outage or Partial Outage.

filter	impact
3G Outage	Full Outage
Cell Blocked
Power Outage
Power Outage	Partial Outage
Cell Blocked

Here is my query:

| eval impact=case(
searchmatch("Cell Blocked"),"Partial Outage",
searchmatch("3G Outage"),"Full Outage",1=1,"No service impact")

Result:

The correct impact should be Full Outage. Can anyone help me out?

Thanks,

Re: Help in using CASE Statement

to4kawa — Sat, 04 Jul 2020 22:46:14 GMT

| makeresults | eval filter=split("3G Outage,Cell Blocked,Power Outage",",") | rename COMMENT as "this is sample" | rename COMMENT as "the logic" | eval impact=case(match(filter,"3G Outage"),"Full Outage",match(filter,"Cell Blocked"),"Partial Outage",1=1,"No service impact")

filter is multivalue ,searchmatch() works only _raw and case() works in order.
How about this?

Re: Help in using CASE Statement

Noob_splunker — Sat, 04 Jul 2020 22:57:51 GMT

@to4kawaawesome!

| eval impact=case(match(filter,"3G Outage"),"Full Outage",match(filter,"Cell Blocked"),"Partial Outage",1=1,"No service impact")

this works fine for me! Thanks!