topic How to return field values from an eval/if statement in Splunk Search

How to return field values from an eval/if statement

RickGenesis — Thu, 16 May 2013 05:00:29 GMT

I am trying to return change data for our servers. basically I import the list of open changes from the change control system, I then run a search (it will be a macro once it works) that checks if the specified server is currently in a change window,if it is it returns the change number if not it returns "operational"

 sourcetype=RFClist Change_Status!=Draft OR Change_Status!=Closed Details="*serverA*" earliest=0 latest=now 
| where time() > strptime(Change_Start_Date, "%F %T") AND time() < strptime(Change_End_Date, "%F %T") 
| stats count as window 
| eval window=if(window==0,"Operational",Change_Number)

when I use a server that is not in a change window I get the "Operational" output, but when I use a server that is in a change window I get nothing. If I just use strings in the eval/if statement I get valid output.

anyone got any ideas?

Re: How to return field values from an eval/if statement

kristian_kolb — Thu, 16 May 2013 05:23:00 GMT

The eval/if looks fine. However, I'm thinking that you'd want to use _time rather than time() in the where statement

Re: How to return field values from an eval/if statement

RickGenesis — Mon, 28 Sep 2020 13:54:46 GMT

_time is the time of the returned events, I am checking if the returned events (changes) are currently(ie now) active. I believe the search statement is correct as if I replace the change_number field with a string e.g "in change" it works perfectly, except I really wanted the change number as part of the output.

Re: How to return field values from an eval/if statement

kristian_kolb — Thu, 16 May 2013 06:54:28 GMT

Oh, then perhaps the Change_Number does not have a value, i.e. is null?