topic Re: If clause with where in Splunk Search

What is the best way to use if clause with where?

appsik — Tue, 20 Jun 2023 02:38:27 GMT

Hello Community,

I have a table:

Filename Status

file1 1

file2 0

| eval Status=if(where Status = 0, "missing file", Status)

If Status = 0 I want to replace 0 with "missing file".

Filename Status

file2 file missing

What is the best way to do this?

Thanks in advance

javiergn — Mon, 19 Jun 2023 10:40:51 GMT

Hi @appsik , your logic is good but there is a typo in your SPL. It should be:

| eval Status=if(Status = 0, "missing file", Status)

Or if you wanted to do partial matching or regex matching you could use match instead:

| eval Status=if(match(Status, "MyRegex"), "missing file", Status)

Hi hope that helps.

appsik — Mon, 19 Jun 2023 11:02:57 GMT

Thank you very much