topic How to run a second command inside the if statment in Splunk Search

How to run a second command inside the if statment

robertlynch2020 — Tue, 05 Apr 2022 13:43:18 GMT

I have a value that could be N/A or a number. The issue is when it is a number, splunk is not picking it up as one.

So I have to run the "convert" command. But I need to check first if it is a N/A.

Below is what I have but it does not work - any ideas?

| eval T_CpuPerc = if(T_CpuPerc="N/A",T_CpuPerc,convert num(T_CpuPerc) )

Re: How to run a second command inside the if statment

gcusello — Tue, 05 Apr 2022 14:14:03 GMT

Hi @robertlynch2020,

if an eval statement you cannot insert a command but only a function (SPL isn't a procedural language!), so if you want to format the number in T_CpuPerc you have to use a formatting function and not the convert command.

In other words, try something like this:

| eval T_CpuPerc = if(T_CpuPerc="N/A",T_CpuPerc,tonumber(T_CpuPerc))

or another function like tostring, round, etc...

Ciao.

Giuseppe

Re: How to run a second command inside the if statment

robertlynch2020 — Tue, 05 Apr 2022 14:29:08 GMT

brilliant - thanks