https://community.splunk.com/t5/Splunk-Search/Search-Top-Field-If-exists/m-p/181431#M52297 <P>Couple of things. First of all, welcome <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Then, <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Eval">eval</A>. You need to specify a field where your <CODE>eval</CODE> can put its content, so a typical command looks like</P> <PRE><CODE>eval check=if(1=1,"world_ok","problems") </CODE></PRE> <P>which would give you a new field called "check" which should always show you that the world is ok.</P> <P>Also, you don't use if like you do in a programming language; see <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">here</A> for how it works (it's related to how <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Eval">eval</A> works). If you want different behavior based on the number of results a search has, you'll ned to do that another way, for example in Javascript (since you're on a dashboard). In your case, an easy solution could be to calculate and show both statistics separately (the one about the <CODE>top exception_type</CODE> returning nothing to see sometimes).</P> Wed, 06 May 2015 11:45:16 GMT jeffland 2015-05-06T11:45:16Z https://community.splunk.com/t5/Splunk-Search/Search-Top-Field-If-exists/m-p/181430#M52296 <P>I'm very new to Splunk, and I'm trying to figure out a way to search by different top fields, depending on whether the first field exists or is not null. Let me try to explain... I have some data that comes in with different severities, and I've created an Extracted Field for an exception_type. The exception_type is only set on rows with a severity of WARN or ERROR.</P> <P>I'm trying to create a dashboard that I can filter using a dropdown by severity, and it will show a chart of counts of events broken down by exception type. If there are no exception types for that severity, I just want to show an overall count. I started with this, and obviously it doesn't work, but it might give an indication of what I'm trying to do:</P> <P>severity=$severity$ | eval if(isnotnull(exception_type),top exception_type,stats count as Total) showperc=0</P> <P>Using "severity=$severity$ | top exception_type showperc=0", and selecting my DD, I get results for WARN and ERROR, but other severities show nothing.</P> <P><IMG src="https://community.splunk.com/storage/temp/35852-warn.png" alt="alt text" /></P> <P><IMG src="https://community.splunk.com/storage/temp/35853-debug.png" alt="alt text" /></P> <P>Thanks, I appreciate any help you can give! - Mark</P> Mon, 28 Sep 2020 19:50:28 GMT https://community.splunk.com/t5/Splunk-Search/Search-Top-Field-If-exists/m-p/181430#M52296 MDClayton 2020-09-28T19:50:28Z https://community.splunk.com/t5/Splunk-Search/Search-Top-Field-If-exists/m-p/181431#M52297 <P>Couple of things. First of all, welcome <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Then, <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Eval">eval</A>. You need to specify a field where your <CODE>eval</CODE> can put its content, so a typical command looks like</P> <PRE><CODE>eval check=if(1=1,"world_ok","problems") </CODE></PRE> <P>which would give you a new field called "check" which should always show you that the world is ok.</P> <P>Also, you don't use if like you do in a programming language; see <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">here</A> for how it works (it's related to how <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Eval">eval</A> works). If you want different behavior based on the number of results a search has, you'll ned to do that another way, for example in Javascript (since you're on a dashboard). In your case, an easy solution could be to calculate and show both statistics separately (the one about the <CODE>top exception_type</CODE> returning nothing to see sometimes).</P> Wed, 06 May 2015 11:45:16 GMT https://community.splunk.com/t5/Splunk-Search/Search-Top-Field-If-exists/m-p/181431#M52297 jeffland 2015-05-06T11:45:16Z