topic Re: How do I edit my if else case eval statement to match my requirement? in Splunk Search

How do I edit my if else case eval statement to match my requirement?

rfiscus — Tue, 29 Sep 2020 07:44:51 GMT

How can I case eval this so that:

if Logon_VM is 202-VM-MS, then MICROSOFT
OR
if Logon_VM is 202-VM-BOB, then BOB'S WAFFLES
ELSE
all the rest will be TEST COMPANY.

This all works up until else the rest are TEST COMPANY.

eval Company = case(Logon_VM == "202-VM-MS","MICROSOFT",Logon_VM == "202-VM-BOB","BOB'S WAFFLES",Logon_VM == "B0-202-VM-*","TEST COMPANY")

Re: How do I edit my if else case eval statement to match my requirement?

rfiscus — Mon, 02 Nov 2015 18:40:47 GMT

I found the answer here, just add any true statement like 1=1, "TEST COMPANY" in the eval statement.

So: eval Company = case(Logon_VM == "202-VM-MS","MICROSOFT",Logon_VM == "202-VM-BOB","BOB'S WAFFLES",1=1,"TEST COMPANY")

Re: How do I edit my if else case eval statement to match my requirement?

jluo_splunk — Tue, 29 Sep 2020 07:44:53 GMT

Case uses an if x, then y pattern, and will default to "NULL" if there is no match. You can change the default value by making the last pairing default to true.

Try this:
eval Company = case(Logon_VM == "202-VM-MS","MICROSOFT",Logon_VM == "202-VM-BOB","BOB'S WAFFLES", 1=1,"TEST COMPANY")

Re: How do I edit my if else case eval statement to match my requirement?

rfiscus — Mon, 02 Nov 2015 18:43:35 GMT

Found it from Ayn on https://answers.splunk.com/answers/26522/if-statment-or-nested-if.html

Re: How do I edit my if else case eval statement to match my requirement?

lisaac — Fri, 20 Jan 2017 16:20:42 GMT

Thanks for this last example. This is what I was looking for in a separate search.

Re: How do I edit my if else case eval statement to match my requirement?

DalJeanis — Fri, 20 Jan 2017 19:57:27 GMT

1) splunk provides a True() function, which you should use in place of the 1=1.
2) I believe that should be 1==1.

Re: How do I edit my if else case eval statement to match my requirement?

DalJeanis — Fri, 20 Jan 2017 19:58:01 GMT

1) splunk provides a True() function, which you should use in place of the 1=1.
2) I believe that should be 1==1.