<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: if-else condition in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/if-else-condition/m-p/92481#M23861</link>
    <description>&lt;P&gt;You could also include it in the stats command directly: &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;stats count(eval(Location==" " OR isnull(Location))
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Wed, 17 Oct 2012 06:46:47 GMT</pubDate>
    <dc:creator>Ayn</dc:creator>
    <dc:date>2012-10-17T06:46:47Z</dc:date>
    <item>
      <title>if-else condition</title>
      <link>https://community.splunk.com/t5/Splunk-Search/if-else-condition/m-p/92479#M23859</link>
      <description>&lt;P&gt;Can I use like this : &lt;/P&gt;

&lt;P&gt;| eval a=if(Location!=" ",stat count by Location)&lt;/P&gt;

&lt;P&gt;but I am getting error..&lt;/P&gt;

&lt;P&gt;actually I want to find..I want to  get the count for those records which are non-blank&lt;/P&gt;

&lt;P&gt;Please help&lt;/P&gt;</description>
      <pubDate>Tue, 16 Oct 2012 19:51:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/if-else-condition/m-p/92479#M23859</guid>
      <dc:creator>abhayneilam</dc:creator>
      <dc:date>2012-10-16T19:51:21Z</dc:date>
    </item>
    <item>
      <title>Re: if-else condition</title>
      <link>https://community.splunk.com/t5/Splunk-Search/if-else-condition/m-p/92480#M23860</link>
      <description>&lt;P&gt;I am not sure that you can use conditional searches, just conditional field calculation using eval.&lt;/P&gt;

&lt;P&gt;another way is to make sure that the field location exits, then count&lt;BR /&gt;
&lt;CODE&gt;| WHERE NOT ( Location=" " OR isnull(Location) ) | stat count by Location&lt;/CODE&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 17 Oct 2012 02:57:01 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/if-else-condition/m-p/92480#M23860</guid>
      <dc:creator>yannK</dc:creator>
      <dc:date>2012-10-17T02:57:01Z</dc:date>
    </item>
    <item>
      <title>Re: if-else condition</title>
      <link>https://community.splunk.com/t5/Splunk-Search/if-else-condition/m-p/92481#M23861</link>
      <description>&lt;P&gt;You could also include it in the stats command directly: &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;stats count(eval(Location==" " OR isnull(Location))
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Wed, 17 Oct 2012 06:46:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/if-else-condition/m-p/92481#M23861</guid>
      <dc:creator>Ayn</dc:creator>
      <dc:date>2012-10-17T06:46:47Z</dc:date>
    </item>
  </channel>
</rss>

