topic Re: How to compare and calculate comparison flag for two fields in Splunk Search

How to compare and calculate comparison flag for two fields

mbasharat — Wed, 10 Apr 2024 23:57:45 GMT

Hi,

I have below scenario. My brain is very slow at this time of the day!

I need an eval to create Status field as in the table below that will flag a host if it is running on IPv4 OR IPv6 OR both IPv4 +IPv6.

HOSTNAME	IPv4	IPv6	Status
SampleA	0.0.0.1		IPv4
SampleB		0.0.0.2	IPv6
SampleC	0.0.0.3	A:B:C:D:E:F	IPv4 + IPv6

Thanks in-advance!!!

Re: How to compare and calculate comparison flag for two fields

richgalloway — Thu, 11 Apr 2024 00:16:21 GMT

There may be a few ways to do that. Here's one.

| eval Status = case(isnotnull(IPv4) AND isnotnull(IPv6), "IPv4 + IPv6", isnotnull(IPv4), "IPv4", isnotnull(IPv6), "IPv6", 1==1, "")

Re: How to compare and calculate comparison flag for two fields

mbasharat — Thu, 11 Apr 2024 14:54:54 GMT

Thanks @richgalloway!!