topic How to write a case statement for this condition? in Splunk Search

How to write a case statement for this condition?

shankarananthth — Thu, 02 Jun 2016 08:38:33 GMT

My values are like:

Miscellanious (Field name )
Off-line|Idle|In Service|
NCR Custom Edition v3.13 build578907|
In Service|Idle|In Service|0|0|0|0|0||030420|G531-0283|0||||
Closed|Idle|In Service|0|0||030420|G531-0283|0||||
Off-line|Idle|In Service|0|0||030420|GEEK|DATA|G531-0283|0||||
Supervisor|Idle|In Service|GEEK|DATA|G531-0283|0||||
Terminal Mode|Idle|In Service|0|0||030420|GEEK|DATA|G531-0283|0||||

From the above data, I need only the value before the first pipe and I need to compare and display as mentioned below ..

These are my attempted approaches:

If the field Miscellanious has the value as "In Service" before the first | (pipe), then output should be "In Service"

|eval Terminal_Mode= case (Miscellanious  =="%In Service","In Service", Miscellanious =="Closed","Closed", Miscellanious =="Off-line","Off-line", Miscellanious == "Supervisor","Supervisor",  Miscellanious =="Terminal Mode","Terminal Mode", a=1,"")

and another one is:

| eval option=if(match(miscellaneous1,"In Service"),"In Service","")
| eval option1=if(match(miscellaneous1,"Closed"),"Closed","")
| eval option2=if(match(miscellaneous1,"Off-line"),"Off-line","")
| eval option3=if(match(miscellaneous1,"Supervisor"),"Supervisor","")
| eval option4=if(match(miscellaneous1,"Terminal Mode"),"Terminal Mode","")
| eval Terminal_Mode=coalesce(option,option1,option2,option3,option4)
| table Terminal_Mode.

But it's not working. Kindly help.
Thanks in advance..

Re: How to write a case statement for this condition?

richgalloway — Thu, 02 Jun 2016 13:03:13 GMT

I think you were close with your case statement.

|eval Terminal_Mode= case (match(Miscellanious,"%In Service%"),"In Service", match(Miscellanious,"Closed%"),"Closed", match(Miscellanious,"Off-line%"),"Off-line", match(Miscellanious, "Supervisor%"),"Supervisor", match(Miscellanious,"Terminal Mode%"),"Terminal Mode", 1=1,"")

Re: How to write a case statement for this condition?

javiergn — Thu, 02 Jun 2016 13:04:20 GMT

Hi,

If I understand correctly, the value of your Miscellanious field is the one you mentioned above, therefore, can you not just do the following:

| rex field=Miscellanious "^(?<Terminal_Mode>[^\|]+)"

Or this:

| eval Terminal_Mode = mvindex(split(Miscellanious, "|"), 0)

Let me know if that works for you.