topic Re: EVAL statement not correct in Splunk Search

EVAL statement not correct

davidcraven02 — Wed, 17 Jan 2018 13:13:01 GMT

My eval statement below is to check if 'Action is Required' only if the below conditions are met, I have also used case and if statement to determine this, however none of these have worked.

Location does not equal Varonis (i.e equals Not in Varonis)
MonitoringStatus does not equal Monitored (i.e equals Not Monitored)
Contains the word "Hosting" in the Path field

| eval VaronisStatus=if(('(g)Location'!="Varonis" AND(MonitoringStatus!="Monitored") AND like(Path,"%Hosting%")),"Action Required", "No Action Required")

|| eval VaronisStatus=case(('(g)Location'!="Varonis" AND(MonitoringStatus!="Monitored") AND like(Path,"%Hosting%")),"Action Required" , 1=1,"No Action Required")

Re: EVAL statement not correct

mayurr98 — Wed, 17 Jan 2018 13:25:21 GMT

try this run anywhere search

|makeresults|eval "(g)Location"="Varonis" |eval MonitoringStatus="NotMonitored"|eval Path="Hosting"| eval VaronisStatus=if('(g)Location'!="Varonis" AND MonitoringStatus!="Monitored" AND like(Path,"%Hosting%"),"Action Required", "No Action Required")

you should try

| eval VaronisStatus=if('(g)Location'!="Varonis" AND MonitoringStatus!="Monitored" AND like(Path,"%Hosting%"),"Action Required", "No Action Required")

let me know if this helps !

Re: EVAL statement not correct

cmerriman — Wed, 17 Jan 2018 13:30:56 GMT

when i run this:

|makeresults|eval "(g)Location"="Varonis" |eval MonitoringStatus="notMonitored"|eval Path="Hosting"| eval VaronisStatus=if(('(g)Location'!="Varonis" AND (MonitoringStatus!="Monitored") AND like(Path,"%Hosting%")),"Action Required", "No Action Required")

i get "No Action Required" and when i change the (g)Location to notVaronis, I get Action Required

what exactly isn't working with this?

Re: EVAL statement not correct

elliotproebstel — Wed, 17 Jan 2018 14:04:11 GMT

Both of your approaches work on my system with test events. I don't see any functional difference between your first approach and the one suggested by @mayurr98 below, but if it works for you, great. If it doesn't, can you share some sample events that are being incorrectly categorized?