Reporting

Eval statement that included AND and OR

Mary666
Communicator

Hello All,

I have been struggling with what seems to be a very simple concept. Can someone please help me correct this eval statement with OR and AND? I would like to display:

if name is in All - in both Department and Station = 0
If name is not in Department =1
if name is in Station =2

I mainly want to get clarity on the structure of my eval statement using OR and AND. 

| eval Name=if(((All=="No" OR All=="Yes") AND Department=="No" AND Station=="Yes"), "0","1", "2")

 

Labels (1)
0 Karma
1 Solution

renjith_nair
Legend

Do you have some sample/dummy data with inputs and expected outputs.

It's bit confusing at first glance , for e.g for value=2, what should be the value of Department?

are you looking for something similar to below?

if (Station="Yes", if(Department="Yes",0,1),2)

 

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

Do you have some sample/dummy data with inputs and expected outputs.

It's bit confusing at first glance , for e.g for value=2, what should be the value of Department?

are you looking for something similar to below?

if (Station="Yes", if(Department="Yes",0,1),2)

 

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...