topic Re: Number of Conditions in case() Statement in Splunk Search

Number of Conditions in case() Statement

michaelsplunk1 — Tue, 30 Mar 2021 22:46:17 GMT

Is there a limit to the number of conditions we can use in a case() statement?

I've reached a point where my ORs and ANDs are no longer being highlighted syntactically and neither are my parenthesis being highlighted with their corresponding opening/closing counterpart when I move the cursor one space beyond one.

Thank you!

Re: Number of Conditions in case() Statement

wkim20 — Mon, 18 Aug 2025 14:04:29 GMT

I too have this same issue, @splunk / splunk team any response to this? i am having the issue to the point where my conditions are not being met and it defaults to another value defined in the case statement condition but the field it is looking does not have the matching value.

Re: Number of Conditions in case() Statement

PrewinThomas — Tue, 19 Aug 2025 04:36:18 GMT

@wkim20

If none of the conditions in a Splunk case() statement are met, it will return the value specified for the default condition.
Can you share your query here, so that we can have a look.

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Number of Conditions in case() Statement

gcusello — Tue, 19 Aug 2025 06:27:37 GMT

Hi @michaelsplunk1 ,

for my knowledge, there isn't any limit to the conditions in a case statement, but there'a limit to the lenght of a search caused not by Splunk (that has no limits) but by the browser.

In this case you can create your search outside Splunk, save it as a savedsearch and execute it using a command like | savedsearch yoursavedsearchname or using a macro.

About highlighting, be sure that there isn't any error in parenthesis and quotes.

Ciao.

Giuseppe

Re: Number of Conditions in case() Statement

wkim20 — Tue, 19 Aug 2025 14:31:01 GMT

only thing i did was to make sure the spaces were available in the query which were updated in the calc metrics. Its just odd this had to be done this way...syntactically it was not wrong nor did Splunk flag as an error when running the query. just odd overall on behavior of this tool and a bit mindful going forward