topic Re: Can you help me with an eval that has conditions? in Splunk Search

Can you help me with an eval that has conditions?

jip31 — Wed, 05 Dec 2018 06:50:09 GMT

hello,

I use the code below in order to test if a filename exists.

It works, but only when I put the token time on "all time".

When I put a short token time like "last hour", there is no "Yes" or "No" but "Any results" message

When there is "Any results", I want to display "No".

Could you help me please??

index="ai-wkst-windows-fr" sourcetype="tools:flags" filename="ACV-TOUPDATE.$w$*" 
| dedup host 
| eval filename=if(filename=="ACV-TOUPDATE.$w$", "YES", "NO") 
| table filename

Re: Can you help me with an eval that has conditions?

nagarjuna280 — Wed, 05 Dec 2018 07:00:16 GMT

what is "any results", do you mean "no results found try expanding time range"

Try this

index="ai-wkst-windows-fr" sourcetype="tools:flags" filename=*
| dedup host
| eval filename=if(filename=="ACV-TOUPDATE.$w$", "YES", "NO")
| table filename

Re: Can you help me with an eval that has conditions?

jip31 — Wed, 05 Dec 2018 07:33:37 GMT

Yes i mean "no results found try expanding time range"
you code dont works because with it I have always "No"

Re: Can you help me with an eval that has conditions?

harishalipaka — Wed, 05 Dec 2018 11:54:19 GMT

hi @jip31

can u try like this

   index="ai-wkst-windows-fr" sourcetype="tools:flags" filename="ACV-TOUPDATE.$w$*" 
     | dedup host 
    |eval token="ACV-TOUPDATE.$w$"
     | eval filename=if(filename==token, "YES", "NO") 
     | table filename

Re: Can you help me with an eval that has conditions?

sdchakraborty — Thu, 06 Dec 2018 06:42:25 GMT

Hi,

Can you try the below search.

 index="ai-wkst-windows-fr" sourcetype="tools:flags" filename="ACV-TOUPDATE.$w$*" 
 | dedup host 
 | append [|makeresults | eval filename = "Not Defined" | table filename]
 | eval filename=if(filename=="ACV-TOUPDATE.$w$", "YES", "NO") 
| head 1
 | table filename

Re: Can you help me with an eval that has conditions?

jip31 — Thu, 06 Dec 2018 08:21:53 GMT

hi
with your code when In change the token time i have two lines with Yes and No.....

Re: Can you help me with an eval that has conditions?

sdchakraborty — Thu, 06 Dec 2018 11:20:52 GMT

Re: Can you help me with an eval that has conditions?

jip31 — Thu, 06 Dec 2018 12:04:39 GMT

Perfect thanks

Re: Can you help me with an eval that has conditions?

sdchakraborty — Thu, 06 Dec 2018 13:14:48 GMT

Cool....I edited my main answer as well