https://community.splunk.com/t5/Splunk-Search/If-statement-with-AND/m-p/230968#M68506 <P>You can use case statement instead the syntax is <BR /> case (condition , TRUE, FALSE)</P> <P>You can have nested case statements as well for eg.<BR /> |index=main | eval system=case(isnotnull(dest) AND dest!="unknown",dest,isnotnull(src) AND src!="unknown",src,isnotnull(dvc) AND dvc!="unknown",dvc,1=1,"unknown")</P> Wed, 17 Aug 2016 11:05:55 GMT hardikJsheth 2016-08-17T11:05:55Z https://community.splunk.com/t5/Splunk-Search/If-statement-with-AND/m-p/230967#M68505 <P>Hi,</P> <P>Is it possible to use AND in an eval if statement.. for instance if(volume =10, "normal" if(volume &gt;35 AND &lt;40, "loud")) and so on.. I would like to add a few more if's into that as well..Any thoughts on how to structure it?</P> Wed, 17 Aug 2016 10:59:30 GMT https://community.splunk.com/t5/Splunk-Search/If-statement-with-AND/m-p/230967#M68505 mansel_scheffel 2016-08-17T10:59:30Z https://community.splunk.com/t5/Splunk-Search/If-statement-with-AND/m-p/230968#M68506 <P>You can use case statement instead the syntax is <BR /> case (condition , TRUE, FALSE)</P> <P>You can have nested case statements as well for eg.<BR /> |index=main | eval system=case(isnotnull(dest) AND dest!="unknown",dest,isnotnull(src) AND src!="unknown",src,isnotnull(dvc) AND dvc!="unknown",dvc,1=1,"unknown")</P> Wed, 17 Aug 2016 11:05:55 GMT https://community.splunk.com/t5/Splunk-Search/If-statement-with-AND/m-p/230968#M68506 hardikJsheth 2016-08-17T11:05:55Z https://community.splunk.com/t5/Splunk-Search/If-statement-with-AND/m-p/230969#M68507 <P>Yes you could do that with if, but the moment you start nesting multiple ifs it's going to become hard to read.<BR /> Why don't you use case instead?</P> <PRE><CODE>eval whatever = case ( volume = 10, "normal", volume &gt; 35 AND volume &lt; 40, "loud", 1 = 1, "default rule" ) </CODE></PRE> Wed, 17 Aug 2016 11:06:24 GMT https://community.splunk.com/t5/Splunk-Search/If-statement-with-AND/m-p/230969#M68507 javiergn 2016-08-17T11:06:24Z