https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-if-then-statement-to-produce-a-result-for-a/m-p/275950#M83247 <P>Hi Everyone,</P> <P>Longtime user of Splunk and come here often to find my answers, but I can't exactly solve the issue I have here.</P> <P>Background of what I'm trying to do:</P> <P>My Dashboard has options for PROD, DEMO. When I select the dropdown, it will change the searches from my production servers to my demo servers. I'm looking at java logging to look at max threads on our tomcat hosts and would like to look at demo logging, but the hard part is, it's a different number for all hosts.</P> <P>Here is my XML:</P> <PRE><CODE>host=$il_env$-ilas* sourcetype=jmx attributevalue="*" attributeID=366 | stats latest(attributevalue) | rangemap field=latest(attributevalue) low=0-2500 elevated=2500-2750 severe=2750-3000 default=none </CODE></PRE> <P>My goal is to use the <CODE>$il_env$</CODE> wildcard to do an if/then statement. If <CODE>host=production</CODE>, the search will use <CODE>attributeID=366</CODE>. If the <CODE>host=demo</CODE>, the search will use <CODE>attributeID=912</CODE>.</P> <P>Any help would be greatly appreciated. </P> Tue, 13 Sep 2016 16:41:08 GMT jnichols914 2016-09-13T16:41:08Z https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-if-then-statement-to-produce-a-result-for-a/m-p/275950#M83247 <P>Hi Everyone,</P> <P>Longtime user of Splunk and come here often to find my answers, but I can't exactly solve the issue I have here.</P> <P>Background of what I'm trying to do:</P> <P>My Dashboard has options for PROD, DEMO. When I select the dropdown, it will change the searches from my production servers to my demo servers. I'm looking at java logging to look at max threads on our tomcat hosts and would like to look at demo logging, but the hard part is, it's a different number for all hosts.</P> <P>Here is my XML:</P> <PRE><CODE>host=$il_env$-ilas* sourcetype=jmx attributevalue="*" attributeID=366 | stats latest(attributevalue) | rangemap field=latest(attributevalue) low=0-2500 elevated=2500-2750 severe=2750-3000 default=none </CODE></PRE> <P>My goal is to use the <CODE>$il_env$</CODE> wildcard to do an if/then statement. If <CODE>host=production</CODE>, the search will use <CODE>attributeID=366</CODE>. If the <CODE>host=demo</CODE>, the search will use <CODE>attributeID=912</CODE>.</P> <P>Any help would be greatly appreciated. </P> Tue, 13 Sep 2016 16:41:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-if-then-statement-to-produce-a-result-for-a/m-p/275950#M83247 jnichols914 2016-09-13T16:41:08Z https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-if-then-statement-to-produce-a-result-for-a/m-p/275951#M83248 <P>Try this</P> <PRE><CODE>&lt;form&gt; &lt;input type="dropdown" token="il_env"&gt; &lt;options&gt; ... &lt;change&gt; &lt;eval token="attr"&gt;if($value$="Prod", 366, 912)&lt;/eval&gt; &lt;/change&gt; &lt;panel&gt; &lt;chart&gt; &lt;search&gt; &lt;query&gt;host=$il_env$-ilas* sourcetype=jmx attributevalue="*" attributeID=$attr$ | stats latest(attributevalue) | rangemap field=latest(attributevalue) low=0-2500 elevated=2500-2750 severe=2750-3000 default=none&lt;/query&gt; &lt;/search&gt; &lt;/panel&gt; &lt;/form&gt; </CODE></PRE> Tue, 13 Sep 2016 19:10:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-an-eval-if-then-statement-to-produce-a-result-for-a/m-p/275951#M83248 sundareshr 2016-09-13T19:10:11Z