Archive

how to write an "if" statement for a value in all the fields?

Path Finder

Hi,

Is there a way of writing an if condition that basically says, "if value x exists in all of tabled fields, then create a new field, and insert the value "valid" into it".

Is that possible?

0 Karma

Champion

It sounds like you're asking that all fields present be equal to the same value (for my search that value will be rightvalue). If that is the case, you can use foreach to check the value of each field, and use some additional logic to accomplish what you are looking for. This run anywhere example shows this in action:

| makeresults 
| eval fieldA="wrongvalue", fieldB="rightvalue", fieldC="rightvalue", fieldD="wrongvalue"
| append [| makeresults | eval fieldA="rightvalue", fieldB="rightvalue", fieldC="rightvalue", fieldD="rightvalue"]
| fields - _time
| foreach * [eval validity=if((isnull(validity) or validity="valid") and <<FIELD>>="rightvalue", "valid", "invalid")]

If you need the new field to be null instead of "invalid", you could add | eval validity=if(validity="valid", validity, NULL)

SplunkTrust
SplunkTrust

@micahkemp, should the isnull(is_valid) be isnull(validity)?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Champion

Yes, thanks, and corrected above. I changed my field names after pasting the search into answers, and I missed that one. Annoyingly the incorrect search actually gave the correct results for those specific test cases.

0 Karma

SplunkTrust
SplunkTrust

hi @mahbs,

Basically you can use Foreach command for search. Your search like below..

YOUR_SEARCH | eval valid="true" | foreach "*"  [ eval valid=if('<<FIELD>>'=="x","true","false") ] 

https://docs.splunk.com/Documentation/Splunk/7.0.1/SearchReference/Foreach

I hope this will help you.

0 Karma