https://community.splunk.com/t5/Splunk-Search/If-Then-To-different-Eval-Statements/m-p/135139#M36932 <P>I'm trying to have a Splunk Alert kick off an email (to an email script) and depending on the search query it should email Address1 or Address2. How do you I create this type of variable? Should I setup a where statement like | where search=Apples | eval email="address1" |where search=Oranges | eval email="address2" ????</P> <P>Example: </P> <P>[search yields Apples] | eval email="address1"</P> <P>[search yields Oranges] | eval email="address2"</P> Mon, 22 Sep 2014 14:02:19 GMT albyva 2014-09-22T14:02:19Z https://community.splunk.com/t5/Splunk-Search/If-Then-To-different-Eval-Statements/m-p/135139#M36932 <P>I'm trying to have a Splunk Alert kick off an email (to an email script) and depending on the search query it should email Address1 or Address2. How do you I create this type of variable? Should I setup a where statement like | where search=Apples | eval email="address1" |where search=Oranges | eval email="address2" ????</P> <P>Example: </P> <P>[search yields Apples] | eval email="address1"</P> <P>[search yields Oranges] | eval email="address2"</P> Mon, 22 Sep 2014 14:02:19 GMT https://community.splunk.com/t5/Splunk-Search/If-Then-To-different-Eval-Statements/m-p/135139#M36932 albyva 2014-09-22T14:02:19Z https://community.splunk.com/t5/Splunk-Search/If-Then-To-different-Eval-Statements/m-p/135140#M36933 <P>You can club if and eval as below.</P> <PRE> eval email=if(mycondition,"address1","address2") </PRE> Mon, 22 Sep 2014 14:17:58 GMT https://community.splunk.com/t5/Splunk-Search/If-Then-To-different-Eval-Statements/m-p/135140#M36933 pradeepkumarg 2014-09-22T14:17:58Z https://community.splunk.com/t5/Splunk-Search/If-Then-To-different-Eval-Statements/m-p/135141#M36934 <P>Can you add a wildcard into mycondition?</P> <P>I see where if(X,Y,Z) says: This function takes three arguments. The first argument X is a Boolean expression. If X evaluates to TRUE, the result is the second argument Y. Optionally, if X evaluates to FALSE, the result evaluates to the third argument Z. </P> <P>My problem now is that (X) is something like 123.45 Gbps or 45.67 Mbps. My goal is to have Gbps send email to address1 and everything go to address2.</P> <P>Example:</P> <P>| eval email=if(BPS="Gbps","address1","address2") </P> <P>The problem appears to be that if I say Gbps or even *Gbps in the X field, neither seem to work. It's only when I specify the exact value like 123.45 Gbps does it actually work. So what I need is a wildcard, but that isn't working. Any suggestions??? </P> <P>Thanks</P> Mon, 22 Sep 2014 15:05:16 GMT https://community.splunk.com/t5/Splunk-Search/If-Then-To-different-Eval-Statements/m-p/135141#M36934 albyva 2014-09-22T15:05:16Z https://community.splunk.com/t5/Splunk-Search/If-Then-To-different-Eval-Statements/m-p/135142#M36935 <P>Yes, you should be able to do it.. You can also try to extract just Gbps and Mbps into a field before the condition and try the comparison on that field.</P> Mon, 22 Sep 2014 15:20:18 GMT https://community.splunk.com/t5/Splunk-Search/If-Then-To-different-Eval-Statements/m-p/135142#M36935 pradeepkumarg 2014-09-22T15:20:18Z https://community.splunk.com/t5/Splunk-Search/If-Then-To-different-Eval-Statements/m-p/135143#M36936 <P>Try this</P> <PRE><CODE>| eval email=if(like(BPS,"%Gbps"),"address1","address2") </CODE></PRE> Mon, 22 Sep 2014 15:23:10 GMT https://community.splunk.com/t5/Splunk-Search/If-Then-To-different-Eval-Statements/m-p/135143#M36936 somesoni2 2014-09-22T15:23:10Z https://community.splunk.com/t5/Splunk-Search/If-Then-To-different-Eval-Statements/m-p/135144#M36937 <P>Thank You !!!! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 22 Sep 2014 15:29:31 GMT https://community.splunk.com/t5/Splunk-Search/If-Then-To-different-Eval-Statements/m-p/135144#M36937 albyva 2014-09-22T15:29:31Z