topic Re: rename everything not included in case() in Splunk Search

rename everything not included in case()

zkenaga — Tue, 29 Sep 2020 14:11:15 GMT

I have eval category=case(false(),'category',like('test',"test_11%"),"11tests",like('test',"test_22%"),"22tests",like('test',"test33%"),"33tests",true(),'test') |

How would I say to rename everything else not included in case()?

Thanks.

Re: rename everything not included in case()

martin_mueller — Tue, 23 May 2017 22:49:04 GMT

I'm confused - the "everything else" part of case() already is present in your example, the final pair: true(), 'test' yielding the value of the field test if all other tests are false.

What do you mean by rename?

PS: The first pair, false(), 'category', is pointless - false() is never true.

Re: rename everything not included in case()

zkenaga — Tue, 23 May 2017 22:52:30 GMT

I apologize if I wasn't descriptive enough. I have 11tests and 22tests grouped together under a common name, what would be a way I could say, "for everything else, call it this"

Re: rename everything not included in case()

zkenaga — Tue, 23 May 2017 23:00:51 GMT

I figured it out after reading what you said more carefully... Thank you again

Re: rename everything not included in case()

martin_mueller — Tue, 23 May 2017 23:16:03 GMT

Do post what you did as an answer, and mark it as accepted.

Re: rename everything not included in case()

dorgra — Sat, 17 Jun 2017 01:16:56 GMT

I'm a noob to Splunk and very interested in this question. As a programmer, why not nest the Case statement inside an IF statement?

Re: rename everything not included in case()

niketn — Sat, 17 Jun 2017 05:01:40 GMT

@dorgra, I think the answer was including true() or 1==1 condition at the end of the case block, to handled everything else:

true(),"EverythingElse"

It is similar to default condition block when all the other conditions are not true.

Re: rename everything not included in case()

DalJeanis — Sat, 17 Jun 2017 17:53:13 GMT

To amplify what @niketnilay said, wrapping an if around a case statement, in pretty much any language, is redundant. The only place it makes sense is in a few ancient languages where the switch/case/evaluate/whateveritwascalled statement is limited to numeric values and the if is not -- or by extension, where the main switch is based on conditionally jumping instructions due to different values of a single test, and you want the if to represent a different test.

Re: rename everything not included in case()

mengler_splunk — Fri, 01 Sep 2017 14:34:04 GMT

Just to put the correct answer in writing:

eval category=case(false(),'category',like('test',"test_11%"),"11tests",like('test',"test_22%"),"22tests",like('test',"test33%"),"33tests",1==1,'everything_else')