topic Re: Help with Splunk search (EVAL command) in Splunk Search

Help with Splunk search (EVAL command)

efelder0 — Tue, 20 Dec 2011 16:43:02 GMT

I am trying to assign a value to a Severity field when the sourcetype = "low" or "Med" or "high".

I.e. - IF sourcetype = Low, then Severity = "Low".

I am certain that an EVAL statement should work here, but not sure what the statement would read??

thx

Re: Help with Splunk search (EVAL command)

Flynt — Tue, 20 Dec 2011 16:54:39 GMT

What about something along the lines of

eval Severity = if (sourcetype="low", "low", if (sourcetype="med", "med", if (sourcetype="high", "high","No Status")))

Re: Help with Splunk search (EVAL command)

efelder0 — Tue, 20 Dec 2011 18:13:55 GMT

I tried that. In fact, here is the actual search string = sourcetype="McAfee ePo - Med" | eval Severity=if(sourcetype=="McAfee ePo - Med", "Medium") | table Severity

I am getting the following error message: [EventsViewer module] Error in 'eval' command: The arguments to the 'if' function are invalid.

Re: Help with Splunk search (EVAL command)

Flynt — Tue, 20 Dec 2011 18:50:52 GMT

Take out the double "=" inside of your eval and give it another parameter - sourcetype="McAfee ePo - Med" | eval Severity=if(sourcetype="McAfee ePo - Med", "Medium",null) | table Severity

The other parameter can be null if you want nothing or another meaningful result as given in the previous example. If you want to evaluate all three Severity types, the example provided before will nest them into one eval.

Re: Help with Splunk search (EVAL command)

efelder0 — Tue, 20 Dec 2011 19:38:09 GMT

OK, this works now:

eval Severity=if(sourcetype=="Low", "Low", null())

Re: Help with Splunk search (EVAL command)

Flynt — Tue, 20 Dec 2011 20:35:56 GMT

Excellent, please upvote and accept if this answer helped you.

Re: Help with Splunk search (EVAL command)

rtadams89 — Wed, 21 Dec 2011 19:48:53 GMT

This is a prime time to use the eval case() function:

| eval Severity = case(sourcetype == "Low", "Low", sourcetype == "Med", "Medium", sourcetype == "High", "High")

Of course, if the value of the "sourcetype" field is always exactly what you want the value of the "Severity" field to be, you could just do:

| eval Severity = sourcetype