topic Re: Correct syntax of eval string case in Splunk Search

Correct syntax of eval string case

itnewbie — Fri, 11 Aug 2023 05:14:05 GMT

I have a "Severity Level" field in both index A and index B.

Their structure is like:

==index A=== Severity Level 1 2 3 4 ===index B=== Severity Level critical high medium low

Now I want to combine the two indexes in a search and display the Severity Level using

| timechart count by "Severity Level"

where the combined "Severity Level" values only contain 1,2,3,4

So, I need an eval = case() to map them.

My syntax for for that is

eval "Severity Level" = case('Severity Level' == "critical", 1 ,'Severity Level' == "high", 2, 'Severity Level' == "medium", 3, 'Severity Level' == "low", 4, 'Severity Level' == 1, 1, 'Severity Level' == 2, 2, 'Severity Level' == 3, 3, 'Severity Level' == 4, 4, 1=1, null)

By this, the result gives incorrect result, i.e., only showing incorrect counts on 4. I think the problem is in the single and double quote, but I am not sure which is which. It is a bit urgent so I need help. Thanks.

Re: Correct syntax of eval string case

bowesmana — Fri, 11 Aug 2023 05:57:50 GMT

There doesn't appear to be anything functionally wrong with the case. With eval, you MUST use single quotes to wrap field names on the RIGHT hand side of the eval, whereas double quotes are used on the LEFT hand side, i.e.

| eval "Severity Level" = case('Severity Level'...)

As you have

This shows your eval is correct

| makeresults | eval "Severity Level"=split("1,2,3,4", ",") | mvexpand "Severity Level" | append [| makeresults | eval "Severity Level"=split("critical,high,medium,low", ",") | mvexpand "Severity Level" ] | fields - _time | eval "Severity Level" = case('Severity Level' == "critical", 1 ,'Severity Level' == "high", 2, 'Severity Level' == "medium", 3, 'Severity Level' == "low", 4, 'Severity Level' == 1, 1, 'Severity Level' == 2, 2, 'Severity Level' == 3, 3, 'Severity Level' == 4, 4, 1=1, null)

but you could just do

| eval "Severity Level" = case('Severity Level' == "critical", 1, 'Severity Level' == "high", 2, 'Severity Level' == "medium", 3, 'Severity Level' == "low", 4, 1==1, 'Severity Level')

as the final case statement is just saying that it will take the value of Severity Level - unless you may have some other value.

Re: Correct syntax of eval string case

jotne — Fri, 11 Aug 2023 07:48:04 GMT

A small tip:

| makeresults | eval "Severity Level"=split("1,2,3,4", ",") | mvexpand "Severity Level"

Can also be created like this:

| makeresults count=4 | streamstats count as "Severity Level"