Splunk Search

Is there any way I can tell eval if command to continue to next iteration if the current condition is false?

nkankur
Path Finder
|eval Column=if(<Condition>,Value<<MATCHSTR>>, Continue to next iteration)

It should jump to next comparison and do noting in the current condition?

Please help

Tags (1)
0 Karma

MonkeyK
Builder

Also not sure what what you mean, but I'll make a couple of guesses.

If you are trying to affect the value of an existing column, sometimes I do it like this:

|eval Column=if(<Condition>,<new value>, Column)

That way, if the condition is not met, the original value is not affected. If the column that you are setting does not exist yet, and you do not want it to exist if not match, I think that could could try something like

|eval Column=if(<Condition>,<new value>, null())
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

I think eval case can help you.

YOUR_SEARCH | eval Column=(<Condition1>,Value1,<Condition2>,Value2,<Condition3>,Value3,...)

For more information see:
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/ConditionalFunctions#case.28X...

Thanks

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi nkankur,
sorry but I don't understand: what do you mean with "Continue to next iteration"?
you put two values in the condition: the first when condition is true, the second when it's false,
when false you can put NULL or space (" ") or 0 and anyway you continue with the execution of eval command for the other events, at the same time output of eval command is used by the commands on the right, e.g.:

my_search
| eval Column=if(<Condition>,"OK", " " )
| search Column="OK"
| ...

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...