topic Re: eval command in Splunk Search

help with eval command

super_saiyan — Wed, 15 Jun 2022 19:16:36 GMT

Hi everyone, i want to use the below command in a single line. i have tried "comma" but it's not working.

How do i do it?

|eval comments= if(Action="create","something has been created",'comments')
|eval comments= if(Action="delete","something has been deleted",'comments')

Thanks.

Re: eval command

gcusello — Wed, 15 Jun 2022 14:06:12 GMT

Hi @super_saiyan,

use two concatenated ifs:

| eval comments= if(Action="create","something has been created", if(Action="delete","something has been deleted",'comments')

or case with the same logic

Ciao.

Giuseppe

Re: eval command

super_saiyan — Wed, 15 Jun 2022 14:16:25 GMT

There is a closing bracket " ) " missing in the SPL.
is it supposed to be that way ?
@gcusello

Re: eval command

somesoni2 — Wed, 15 Jun 2022 15:16:06 GMT

Use the case command, like this

|eval comments= case(Action="create","something has been created", Action="delete","something has been deleted", true(),'comments')

The option "true()" is for default option (when all preceding conditions do not match).

Re: eval command

gcusello — Wed, 15 Jun 2022 15:22:23 GMT

Hi @super_saiyan,

yes sorry!

| eval comments= if(Action="create","something has been created", if(Action="delete","something has been deleted",'comments'))

does it run and solves your need?

Ciao.

Giuseppe

Re: eval command

super_saiyan — Wed, 15 Jun 2022 16:14:24 GMT

Yes, It ran and solved my issue. Thank you so much as always.
@gcusello