topic combine two evals in to a single case statement in Splunk Search

combine two evals in to a single case statement

codedtech — Thu, 24 Sep 2020 16:38:07 GMT

I have 1600+ storage arrays and they are from multiple vendors, each with different thin provisioning levels. I currently have two columns one called TP at 1.2 and one called TP at 1.5. I'd like to combine them into a single column. I tried an if statement, but I couldn't get it right, I'm thinking I need to use a case statement but I'm not sure. Here is an example

eval "Thin Prov"=Case(((SV='vendorA' AND SM='MODEL1' OR SM='Model2'),(TC*1.5), (SV='vendorb' AND SM='Model3' or SM='Model4',TC*1.2))

Re: combine two evals in to a single case statement

ITWhisperer — Thu, 24 Sep 2020 18:36:33 GMT

If column "TP at 1.2" and "TP at 1.5" are mutually exclusive i.e if "TP at 1.2" has a value then "TP at 1.5" is null and vice versa then try:

| eval "Thin Prov"=if(isnull('TP at 1.2'),"TC*1.5","TC*1.2")

Re: combine two evals in to a single case statement

codedtech — Fri, 25 Sep 2020 13:38:23 GMT

@ITWhisperer unfortunately they are not mutually exclusive. I was thinking something like this should work but I can't seem to get it right.

eval TP=case(((storage-model="A" OR storage-model="B"), (TCap*1.5)-LProv))

Re: combine two evals in to a single case statement

ITWhisperer — Fri, 25 Sep 2020 13:49:22 GMT

You have too many brackets

eval TP=case((storage-model="A" OR storage-model="B"), (TCap*1.5)-LProv, condition2, value2, etc, etc)