topic Re: Eval function as result of IF statement in Splunk Search

Eval function as result of IF statement

balcv — Mon, 02 Oct 2023 03:07:09 GMT

Is it possible to have the true and false parts of an if statement contain eval statements.

| eval pwdExpire=if(type="staff", | eval relative_time(_time, "+90day") , | eval relative_time(_time, "+180day") )

Desired results is:
If type="staff" calculate pwdExpiry as _time + 90 days, else calculate pwdExpiry as _time + 180 days.

I will then format pwdExpiry and display in a table.

Re: Eval function as result of IF statement

chris_barrett — Mon, 02 Oct 2023 05:58:38 GMT

The following should do what you want:

| eval pwdExpire = if(type="staff", strftime(relative_time(_time, "+90d"),"%F %T"), strftime(relative_time(_time, "+180d"),"%F %T") )

You may need to adjust the time format (I've used %F %T) to suit your requirements.

Re: Eval function as result of IF statement

balcv — Mon, 02 Oct 2023 21:08:11 GMT

Perfect @chris_barrett . Thanks for the response.

Re: Eval function as result of IF statement

PickleRick — Mon, 02 Oct 2023 21:11:30 GMT

One additional remark about time manipulation - don't render it to a string unless you are absolutely sure you won't be doing anything else with it. And even better - don't render the _value_ to a string - leave the value in an epoch timestamp but use fieldformat command to only display it rendered to a string.