topic Splunk Reporting- condition where I have to create a new field based off some column values? in Splunk Search

Splunk Reporting- condition where I have to create a new field based off some column values?

revanthammineni — Mon, 06 Mar 2023 14:59:54 GMT

Hi Splunkers,

I'm working on a condition where i have to create a new field based off some column values.
Example:
Column A      Column B         column c
yes                    no                        abc
yes                   yes                        ef
yes                   no                          gh
no                     no                    kl
no                     no                          mn
Based of the columns, I need to create a new field called "result" based of two conditions.
1. if column c is abc or gh or mn then result is "yes"
2. If Column A or Column B is yes, then result should be "yes"

I tried doing with eval but one is replacing with other condition. I want to apply the first condition first and for the remaining values I need to check for second condition.

Re: Splunk Reporting

ITWhisperer — Mon, 06 Mar 2023 11:02:37 GMT

| eval result=if(c=="abc" OR c=="gh" OR c=="mn","yes",if(a=="yes" OR b=="yes","yes",null()))

Re: Splunk Reporting

Tom_Lundie — Mon, 06 Mar 2023 10:57:43 GMT

There are a few ways to approach this.

The if syntax is as follows:
| eval field = if(condition, match_value, no_match_value)

The crux of the solution is nest your second condition within the no_match_value. For example:

| eval result=if(IN('column c', "abc", "gh", "mn"), "yes", if('Column A'="yes" OR 'Column B'="yes", "yes", "no"))

Re: Splunk Reporting

Tom_Lundie — Mon, 06 Mar 2023 11:01:09 GMT

Watch out for the extra double-quote just before the "abc".

Re: Splunk Reporting

revanthammineni — Mon, 06 Mar 2023 19:22:58 GMT

Worked like a charm. Thank you!!