topic Re: How to modify output based on condition applied to each rows in Splunk Search

How to modify output based on condition applied to each rows

ibob0304 — Fri, 23 Feb 2018 06:14:38 GMT

I have a query that output below, Status column is generated based on if condition.

|eval Status = if(Quantity>10,Good,BAD)

Output

Name           Quantity           Status
pen                20              Good    
book               13              Good
riddle             2               Bad
note               60              Good

Is it possible to apply if or any other conditions to each row ? like if pen Quantity is more than 1 then say Good,
if book Quantity is less than 10 is Bad ?. In short, applying conditions to each row instead of applying at one column level.

Re: How to modify output based on condition applied to each rows

493669 — Fri, 23 Feb 2018 06:25:07 GMT

You can try like:

...|eval Status=if (Name="pen" AND Quantity >1 ,"Good", "Bad")

Re: How to modify output based on condition applied to each rows

mayurr98 — Fri, 23 Feb 2018 07:35:57 GMT

Yes you can are caseif you are looking for applying conditions to each row

You can try something like

...|eval Status=case(Name="pen" AND Quantity>1,"Good",Name="book" AND Quantity<10,"Bad")

In this way you can add condition for other rows as well i.e. for riddle note and so on.

let me know if this helps!

Re: How to modify output based on condition applied to each rows

ibob0304 — Tue, 27 Feb 2018 01:22:20 GMT

That worked.. Thank you