topic Eval=case not working in Splunk Search

Eval=case not working

stevenbutterwor — Mon, 26 Feb 2018 12:18:51 GMT

Probably a simple one but......my Eval case statement does not seem to work correctly

...| eval operation=case(TagValue >0, "Running", True(), "Off") | table TagValue operation

When the TagValue is 0.00446 I am still getting "Running". Any idea why?

Re: Eval=case not working

FrankVl — Mon, 26 Feb 2018 12:50:19 GMT

Because 0.00446 is larger than 0?

Re: Eval=case not working

kamlesh_vaghela — Mon, 26 Feb 2018 12:53:50 GMT

Hi @stevenbutterworth,

As per condition defined in case, if TagValue is greater than 0 then "Running". And your TagValue is 0.00446 So getting value "Running" is proper. Can you please clear me if I'm wrong..?

Re: Eval=case not working

bjoernhansen — Mon, 26 Feb 2018 14:46:32 GMT

Would agree on that. Also, for the case shown above, you can simply use if() instead of case() 🙂