topic Re: Is there a better way to write EVAL to modify information in a chart in Splunk Search

Is there a better way to write EVAL to modify information in a chart

kshanky143 — Sat, 11 Apr 2015 21:28:31 GMT

I have the query which yields the results i want, but i would like to know if there's a cleaner way to achieve my goal.

I have the following table
Source ------------------------- Item3Count
Item1 ----------------------------- 1
Item2 ----------------------------- 1
Item3 ----------------------------- 22
Item4 ----------------------------- 1

I would like to modify the above table to look like this (should show count value for item3 only)
Source ------------------------- Item3Count
Item1 ----------------------------- 0
Item2 ----------------------------- 0
Item3 ----------------------------- 22
Item4 ----------------------------- 0

Currently my query looks like this ... It works but i feel like its too many lines of query to make small modification. Please let me know if there's a better way to write the same query

| chart values(Item3Count) by Source
| eval Item3Count=if(match(source,"item1"),0,Item3Count)
| eval Item3Count=if(match(source,"item2"),0,Item3Count)
| eval Item3Count=if(match(source,"item4"),0,Item3Count)

Thanks
Sheshank

Re: Is there a better way to write EVAL to modify information in a chart

sideview — Sat, 11 Apr 2015 21:43:42 GMT

You really only need one of these for the "item3" row. The way you're doing it is harder cause you have to match all the other rows. Better to do the reverse and match only the one you want. The rest will get zeros when source does not match "item 3".

| eval Item3Count=if(match(source,"item3"),0,Item3Count)

Re: Is there a better way to write EVAL to modify information in a chart

kshanky143 — Sat, 11 Apr 2015 23:05:49 GMT

Do you mean this .. ? I think u missed '!'
| eval Item3Count=if(!match(source,"item3"),0,Item3Count)

Re: Is there a better way to write EVAL to modify information in a chart

sideview — Sat, 11 Apr 2015 23:24:27 GMT

Oh right. You want the other way around. Sorry.

| eval Item3Count=if(match(source,"item3"),Item3Count,0)

Re: Is there a better way to write EVAL to modify information in a chart

ngatchasandra — Mon, 13 Apr 2015 07:17:44 GMT

Hi kashanky143,

Look this:

| chart values(Item3Count) by Source 
| eval Item3Count=if(match(source,"item1") OR match(source,"item2") OR match(source,"item4"),0,Item3Count)

Re: Is there a better way to write EVAL to modify information in a chart

chimell — Mon, 13 Apr 2015 07:50:03 GMT

Hi kshanky143
You can also use this :

    ....|replace 1 with 0 in Item3Count

Re: Is there a better way to write EVAL to modify information in a chart

kshanky143 — Tue, 14 Apr 2015 00:49:13 GMT

Item1, Item2, Item3 can have any value.