https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-have-expression-in-case-command-for-argument-Y/m-p/683111#M233308 <P>Thank you for reply. I did a simple test on simple text event data and |eval test=case(x=="X", a+b) does work.</P><P>&nbsp;</P> Wed, 03 Apr 2024 23:03:44 GMT billchen99k 2024-04-03T23:03:44Z https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-have-expression-in-case-command-for-argument-Y/m-p/683077#M233300 <P>is it possible to have expression in case command for argument Y?</P><P>case(x,y)</P><P>|eval test=case(x=="X", 'a+b')&nbsp;</P><P>The Y argument, instead of a strings or number, can it be an expression like field a + field b?</P><P>&nbsp;</P><P>Thanks</P><P>&nbsp;</P><P>&nbsp;</P> Wed, 03 Apr 2024 17:31:37 GMT https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-have-expression-in-case-command-for-argument-Y/m-p/683077#M233300 billchen99k 2024-04-03T17:31:37Z https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-have-expression-in-case-command-for-argument-Y/m-p/683084#M233301 <P>The <FONT face="courier new,courier">Y</FONT> argument can be anything valid for an <FONT face="courier new,courier">eval</FONT> statement.&nbsp; IOW, if</P><LI-CODE lang="markup">| eval test=Y</LI-CODE><P>works then</P><LI-CODE lang="markup">| eval test=case(X, Y)</LI-CODE><P>should also work.</P> Wed, 03 Apr 2024 18:54:24 GMT https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-have-expression-in-case-command-for-argument-Y/m-p/683084#M233301 richgalloway 2024-04-03T18:54:24Z https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-have-expression-in-case-command-for-argument-Y/m-p/683111#M233308 <P>Thank you for reply. I did a simple test on simple text event data and |eval test=case(x=="X", a+b) does work.</P><P>&nbsp;</P> Wed, 03 Apr 2024 23:03:44 GMT https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-have-expression-in-case-command-for-argument-Y/m-p/683111#M233308 billchen99k 2024-04-03T23:03:44Z https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-have-expression-in-case-command-for-argument-Y/m-p/683115#M233312 <P>If your problem is resolved, then please click the "Accept as Solution" button to help future readers.</P> Thu, 04 Apr 2024 00:09:33 GMT https://community.splunk.com/t5/Splunk-Search/is-it-possible-to-have-expression-in-case-command-for-argument-Y/m-p/683115#M233312 richgalloway 2024-04-04T00:09:33Z