Condition

[Khuzair81]

c1 = US, c2 = UAE

L1 = English, L2 = Arabic

I want to get the answer in "ans" like, 

If c1= US, 

    then ans= L1

elseif c2 = UAE, 

     then ans= L2

[richgalloway]

Splunk supports conditions using the if and case functions.  RTM at https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/ConditionalFunctions

Some examples, using a modification of the example logic (which will never execute the else clause):

| eval ans=if(c="US", "English","Arabic")

| eval ans=case(c="US", "English", c="UAE", "Arabic", 1==1, "Other")

| eval L1="English", L2="Arabic"
| eval ans=case(c="US", L1, c="UAE", L2, 1==1, "Other")

[Khuzair81]

1. @richgalloway

Please help in the below Query

c=US, UAE

Lang=English, Arabic

........... | rex fields=Lang "(? <myval>)" 

|  eval ans=case(c="US",myval)  | table ans, myval

I'm getting the 'ans' field as blank while 'myval' field has the Value.

[kamlesh_vaghela]

@Khuzair81 

Can you please try this?

YOUR_SEARCH
| eval c=split(c,","), Lang=split(Lang,",")
| eval Ans = mvindex(Lang,mvfind(c,"US"))
| table Ans

Here "US" is the value what I want to get Lang.

My Sample Search :

| makeresults 
| eval c="US,UAE",Lang="English,Arabic"
| eval c=split(c,","), Lang=split(Lang,",")
| eval Ans = mvindex(Lang,mvfind(c,"US"))
| table Ans

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[richgalloway]

The 'ans' field is blank because the 'c' field value is not "US".  If none of the expressions in a case function evaluate to true then the result is NULL.  That is why it's good practice to ensure the last expression always is true by using "1==1" or "true()".

[Khuzair81]

@richgalloway

c= US

Language = abcdENGLISH123qw

..... | rex fields=Language "\w{4}(?<myval>)\d{4}"

|  eval ans=case(c="US",myval, true(),  "NA" )  | table ans, myval, c

Result

ans = NA

myval = English

c = US

I want the ans = English