topic Re: Why eval case with comparison operators doesn't return expected result? in Splunk Search

Why eval case with comparison operators doesn't return expected result?

hcastell — Mon, 06 Oct 2014 16:26:46 GMT

Hi all, I am using the following search string to determine if a specific value in a table falls between 34 and 50 (pass) or >50 OR <34 (fail):

eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr >="50" AND TestTxPwr >="34", "Pass", TestTxPwr > "50" OR TestTxPwr < "34", "Fail")

The above works fine except when the value us actually =50 then the result show fail. Trying to figure out what I am missing. A value of 50 should be a pass. Appreciate any insight you could offer.

Howard.

Re: Why eval case with comparison operators doesn't return expected result?

hcastell — Mon, 28 Sep 2020 17:48:17 GMT

Correction to my search string:

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a", "Fail", TestTxPwr <="50" AND TestTxPwr >="34", "Pass", TestTxPwr > "50" OR TestTxPwr < "34", "Fail")

This is the one I am having issues with.

Re: Why eval case with comparison operators doesn't return expected result?

ppablo — Mon, 06 Oct 2014 16:56:27 GMT

Hi @hcastell

Just taking a stab at this, but would this work for your case?

| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a" OR TestTxPwr > "50" OR TestTxPwr < "34", "Fail", TestTxPwr <="50" AND TestTxPwr >="34", "Pass")

Re: Why eval case with comparison operators doesn't return expected result?

hcastell — Mon, 06 Oct 2014 17:28:15 GMT

Thanks for your suggestion but the result was the same (ie. still does not work). Here is the value that I am testing against from the xml file:

50.0 dBmV

Re: Why eval case with comparison operators doesn't return expected result?

hcastell — Mon, 06 Oct 2014 17:29:20 GMT

The field that I added to my comment didn't come out properly so let me try again using quotes:

"50.0 dBmV"

Re: Why eval case with comparison operators doesn't return expected result?

lguinn2 — Mon, 06 Oct 2014 17:45:50 GMT

The greater than (>) and less than (<) do not work for strings, only for numeric fields.

Therefore, try this instead

 yoursearchhere
| eval TestTxPwrNum=TestTxPwr
| convert  rmunit(TestTxPwrNum)
| eval DOCSIS_TxPWR_Rdy=case(TestTxPwr=="n/a" OR TestTxPwrNum > 50 OR TestTxPwrNum < 34, "Fail",
     TestTxPwrNum <=50 AND TestTxPwrNum >=34, "Pass")

Re: Why eval case with comparison operators doesn't return expected result?

hcastell — Mon, 06 Oct 2014 23:06:47 GMT

Thanks for your suggestion. All is working now.