eval if clarification

bonnlbbelandres — Thu, 24 Nov 2016 15:48:49 GMT

I have a document field that opens a document if available and it displays "no document found" if there is no document available.
But i want to add something to the document field.

i want to have a checkpoint that says pass or fail. If PASS, it should display either "document available" or "no document found"
if FAIL, it should display "Try again"

so im thinking,
is "eval if command" capable with this?

|eval document = if (checkpoint == "pass", ??? , "Try again")

i wanted to make that question mark the document field that displays "document available" or "no document found"

is it possible?

Re: eval if clarification

gokadroid — Thu, 24 Nov 2016 17:13:46 GMT

Yes you can do that similar to my example below:

In my example below, abc is the new variable I create. processState is another variable which will have active or ft, on which I am checking for status. Based on active status, I use another variable cpuUsage which will have more than one kind of value and get assigned to abc. If status is not active then I put "NA"

|eval abc=if(processState="active", cpuUsage, "NA")

So similarly you can make your own case which should work fine.

topic Re: eval if clarification in Splunk Search

eval if clarification

Re: eval if clarification