topic How do I get over conditional functions formatting? in Splunk Search

How do I get over conditional functions formatting?

Stives — Thu, 23 Jun 2022 18:10:27 GMT

Hello community,

like to ask for support to get over conditional formatting. I have 3 different products in a group. Product A, B and C and I need to add for each of them a different formula (compensation factor) e.g..

PRODUCT A = group/3.33*100

PRODUCT B = group/3.061*100

PRODUCT C = group/3.0*100

I could only do this when I create search only for one PRODUCT. But how to include all the PRODUCTS with different formulas (compensation factors) ?

| where group="PRODUCT_A"
| eval ProductGroup=group/3.33*100

Thanks

Re: Conditional functions

richgalloway — Tue, 21 Jun 2022 15:28:09 GMT

A case function should do the job.

| eval ProductGroup = case(product=A, group*100/3.33, product=B, group*100/3.061, product=C, group*100/3.0)

Re: Conditional functions

Stives — Tue, 21 Jun 2022 17:47:47 GMT

Hello, not really as the formula does not work unfortunately.

I want eval a group = case (in the row "group", for a VALUE A divided by 3.33*100, in the row "group", for a value B divided by 3.061*100, in the row "group", for a VALUE C divided by 3.0*100)

Thanks

Re: Conditional functions

Stives — Tue, 21 Jun 2022 17:49:30 GMT

I want eval a row called RML = case (in the row "group", for a VALUE A divided by 3.33*100, in the row "group", for a value B divided by 3.061*100, in the row "group", for a VALUE C divided by 3.0*100)

Re: Conditional functions

richgalloway — Tue, 21 Jun 2022 19:41:21 GMT

Please elaborate on "does not work". What results do you get and how do they not meet expectations?

It might help if you shared actual (sanitized) events.

Re: Conditional functions

marysan — Wed, 22 Jun 2022 04:57:40 GMT

|eval ProductGroup=case(group=="PRODUCT_A",group/3.33*100 ,group=="PRODUCT B",group/3.061*100,group=="PRODUCT C",group/3.0*100)

Re: Conditional functions

richgalloway — Wed, 22 Jun 2022 13:03:27 GMT

This looks like a faithful interpretation of the OP's question, but won't work because if the group field is a string (contains "PRODUCT_x") then it cannot be divided by a number.

Re: How do I get over Conditional functions formatting?

Stives — Thu, 23 Jun 2022 07:01:43 GMT

Hello Rich,

thanks for message. Finally I´ve managed apply case function and resolved the issue.
Thanks for support.

Re: How do I get over Conditional functions formatting?

richgalloway — Thu, 23 Jun 2022 12:48:25 GMT

If your problem is resolved, then please click one of the "Accept as Solution" buttons to help future readers.