https://community.splunk.com/t5/Splunk-Search/Eval-and-If-else-value-return-or-else-null/m-p/336724#M99907 <P>Thanks that worked ..if i want to capture word or digit In case 5 -7 digit number or 5-8 word id.</P> Mon, 16 Apr 2018 12:56:46 GMT Splunk_rocks 2018-04-16T12:56:46Z https://community.splunk.com/t5/Splunk-Search/Eval-and-If-else-value-return-or-else-null/m-p/336722#M99905 <P>Hello Splunkers,</P> <P>Im constructing Eval field " user1" actually user field contain 5 digit number so i have to construct a EVAL field like </P> <P>index= XXX| "xxxxx" |eval user1 = if((user_pin &gt; 0), "user_pin", "Unknown") | table user1 user_pin</P> <P>If "user1" field is 7 digit then in just return actual 7 digit number or else if it is string just say "null value"</P> <P>EVAL-user = if((user1== 5 digit number ) "reportactull number ", "report null value ")</P> <P>Please let me know </P> Tue, 29 Sep 2020 19:02:31 GMT https://community.splunk.com/t5/Splunk-Search/Eval-and-If-else-value-return-or-else-null/m-p/336722#M99905 Splunk_rocks 2020-09-29T19:02:31Z https://community.splunk.com/t5/Splunk-Search/Eval-and-If-else-value-return-or-else-null/m-p/336723#M99906 <P>You say both <CODE>7-digit</CODE> and <CODE>5-digit</CODE> but I am assuming that you mean the latter, so like this:</P> <PRE><CODE>EVAL-user=if(match(user1, "^\d{5}$"), user1, "null value") </CODE></PRE> Sun, 15 Apr 2018 22:49:06 GMT https://community.splunk.com/t5/Splunk-Search/Eval-and-If-else-value-return-or-else-null/m-p/336723#M99906 woodcock 2018-04-15T22:49:06Z https://community.splunk.com/t5/Splunk-Search/Eval-and-If-else-value-return-or-else-null/m-p/336724#M99907 <P>Thanks that worked ..if i want to capture word or digit In case 5 -7 digit number or 5-8 word id.</P> Mon, 16 Apr 2018 12:56:46 GMT https://community.splunk.com/t5/Splunk-Search/Eval-and-If-else-value-return-or-else-null/m-p/336724#M99907 Splunk_rocks 2018-04-16T12:56:46Z https://community.splunk.com/t5/Splunk-Search/Eval-and-If-else-value-return-or-else-null/m-p/336725#M99908 <P>I need to match below to construct eval field.</P> <P>user<BR /> X234578<BR /> wertyui<BR /> kxtur<BR /> lytue23</P> Tue, 17 Apr 2018 15:44:02 GMT https://community.splunk.com/t5/Splunk-Search/Eval-and-If-else-value-return-or-else-null/m-p/336725#M99908 Splunk_rocks 2018-04-17T15:44:02Z https://community.splunk.com/t5/Splunk-Search/Eval-and-If-else-value-return-or-else-null/m-p/336726#M99909 <P>Change <CODE>d{5}</CODE> to <CODE>d{5-8}</CODE> or similar.</P> Fri, 20 Apr 2018 04:19:35 GMT https://community.splunk.com/t5/Splunk-Search/Eval-and-If-else-value-return-or-else-null/m-p/336726#M99909 woodcock 2018-04-20T04:19:35Z