topic Re: My case statement works until I add an AND to it in Splunk Search

Why does the case statement works until an AND is added to it?

azvargas — Thu, 23 Jul 2020 04:27:19 GMT

When I have this case statement like this, it "works". It runs and puts values in the iSeries column, but they are wrong.

| eval Platform=case((source="A" OR source="B" OR source="C") , "iSeries", true(),"Other")

When I add an AND to it so that it fulfills the true condition, no values are put in the iSeries column, and everything goes to Other.

| eval Platform=case((source="A" OR source="B" OR source="C") AND (dest=X OR dest=Y OR dest=Z), "iSeries", true(),"Other")

What am I doing wrong?

Re: My case statement works until I add an AND to it

isoutamo — Wed, 22 Jul 2020 21:16:44 GMT

Is your dest X or "X"?

| makeresults | eval source="A", dest="X" | eval Platform=case((source="A" OR source="B" OR source="C") AND (dest="X" OR dest="Y" OR dest="Z"), "iSeries", true(),"Other")

Re: My case statement works until I add an AND to it

to4kawa — Wed, 22 Jul 2020 21:38:16 GMT

In eval statement,

dest=x means the field dest equals the field x.
As @isoutamo says, you need quotes.

Re: My case statement works until I add an AND to it

azvargas — Thu, 23 Jul 2020 12:07:54 GMT

I've tried with and without quotes, and it still doesnt work.

Re: My case statement works until I add an AND to it

to4kawa — Thu, 23 Jul 2020 12:47:57 GMT

>It runs and puts values in the iSeries column.

your working query puts "iSeries" text on Platform field(column).

>it still doesnt work.
what's your expected result?

Re: My case statement works until I add an AND to it

azvargas — Thu, 23 Jul 2020 13:47:47 GMT

Correct, my query puts "iSeries" text in the Platform field. But it only works without the AND clause, but this is not the right condition. I need it to work with the AND clause portion.

Re: My case statement works until I add an AND to it

isoutamo — Thu, 23 Jul 2020 15:35:05 GMT

Can you print dest and X etc. if those are fields and not values?

Re: My case statement works until I add an AND to it

azvargas — Thu, 23 Jul 2020 18:05:26 GMT

I'd like to add that I have had this same criteria for close to a year in a dashboard just not in a case statement and it works.

Re: My case statement works until I add an AND to it

azvargas — Mon, 27 Jul 2020 19:05:54 GMT

> Can you print dest and X etc. if those are fields and not values?

Not sure how to do this. Its a long query.

Re: My case statement works until I add an AND to it

isoutamo — Mon, 27 Jul 2020 19:12:15 GMT

e.g.

| makeresults | eval foo="A", bar=foo | eval foobar= "'" . foo . "' '" . bar . "'" | table foo bar foobar