topic Re: If-statement does not work in Splunk Search

If-statement does not work

HeinzWaescher — Thu, 24 Jul 2014 09:04:35 GMT

Hi,

my search looks like this:

...
| eval month=strftime(_time, "%Y_%m")
| chart dc(user_id) as count by user_id, month
| stats dc(eval(if(2013_11="1" AND 2013_12="1", user_id, null()))) AS output

The stats command does not work and I don't know why

"Error in 'stats' command: The eval expression for dynamic field 'eval(if(2013_11="1", account_id, null()))' is invalid. Error='The expression is malformed. Expected ).' "

I've used such a command many times before and Splunk never complained about it.

Heinz

Re: If-statement does not work

strive — Mon, 28 Sep 2020 17:09:50 GMT

Why are you using 2013_11 and 2013_12 in if condition. Could you please tell us what are you trying there?
You need to use month in if, not its value. If you give us more details we can help you to write the search

Re: If-statement does not work

HeinzWaescher — Thu, 24 Jul 2014 09:24:17 GMT

These are the column names after the chart command. The Stats command should count number the users if the value in both columns is "1"

Re: If-statement does not work

HeinzWaescher — Mon, 28 Sep 2020 17:09:52 GMT

In the end, I want to have a chart that shows the number of active users in 2013_12, who have been active in 2013_11 as well.

I'm wondering, why it is not possible to use it in the if command? Using it as " | search 2013_01="1" is working, so Splunk seems to know that it is the fieldname here

Re: If-statement does not work

HeinzWaescher — Thu, 24 Jul 2014 09:57:52 GMT

I just tried out another apporach and it seems to work fine:

...
| eval month=strftime(_time, "%Y_%m")
| stats values(month) AS months by user_id
| stats dc(eval(if(months="2013_11" AND months="2013_12", user_id, null()))) AS users

Re: If-statement does not work

martin_mueller — Thu, 24 Jul 2014 11:25:54 GMT

Non-standard field names have to be enclosed in single quotes for where and eval:

... | stats dc(eval(if('2013_11'="1" AND '2013_12'="1", user_id, null()))) AS output

Re: If-statement does not work

HeinzWaescher — Thu, 24 Jul 2014 12:05:53 GMT

thank you very much!