topic Re: Using AND in case() function in Splunk Search

Using AND in case() function

Paxxxman — Mon, 28 Sep 2020 12:06:39 GMT

Hi all,

I'm currently trying to get the case() function working so that for each .csv file I have (which has information saved in the exact same format as the other, even though the information is pertaining to different things entirely) I can turn the information back into meaningful data.

Example - .csv files are named SHB_00X_[DATE].csv where X ranges from 1-8. Each of those .csv files bring in a value LANE, ranging from 1-3 or 1-4. However, the actual lanes in our system range from 1-19. So when I do a standard "stats count by LANE", I only get counts on lanes 1-4, but I need a count for 1-19.

So I tried to change the LANE name with the following case function:

eval RoadLane=case(source="C:\Project\TIRTL\Destination\SHB_001_*" AND LANE=="1", "17", source="C:\Project\TIRTL\Destination\SHB_001_*" AND LANE=="2", "18", source="C:\Project\TIRTL\Destination\SHB_001_*" AND LANE=="3", "19")

and the case() function goes on and on to sort out each lane by source AND lane. The search does not work at all. Any ideas why that is?

All help is appreciated! Thanks!

Re: Using AND in case() function

hexx — Wed, 18 Jul 2012 03:41:07 GMT

I would try the like() eval function instead:

| eval RoadLane=case(like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="1","17", like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="2","18",like(source,"C:\Project\TIRTL\Destination\SHB_001_%") AND LANE=="3","19")

Re: Using AND in case() function

Paxxxman — Wed, 18 Jul 2012 22:42:06 GMT

That did it! Thank you so much.

Re: Using AND in case() function

hexx — Wed, 18 Jul 2012 22:47:00 GMT

Glad to hear that! Please feel free to accept my answer 🙂

Re: Using AND in case() function

Paxxxman — Thu, 19 Jul 2012 00:02:57 GMT

Woops I didn't see that! Hahaha thanks again!