Reporting

If Statement with different fields

Mary666
Communicator

Hello Splunk Community, 

I have not mastered complex if statements. I would like to know how I can get the following results:

1. If  cookies are >=1 then output should be "Failure"

2. If cookies are < 0 then output should also be "Failure"

3. If cookies are = 0 AND if stage for this scenario is not ready, then output should be "In Progress" 

Below is my logic for this query, but its not providing any results and its malformed, any help is appreciated. 

 

| eval Bakes=if(cookies>="1", "Failure"), if (cookies<"0" "Failure"), if (cookies="0", "In Progress" AND Stages!="NotReady", "In Progress")

 



0 Karma
1 Solution

to4kawa
Ultra Champion
| makeresults count=10
| eval cookies=(random() % 3) - 1, Stages=mvindex(split("NotReady,Ready",","),random() % 2)
| eval Bakes=case(cookies >=1 OR cookies < 0, "Failure", cookies="0" AND Stages!="NotReady", "In Progress",true(), "Failure")
| table cookies Stages Bakes

How about case?

View solution in original post

0 Karma

nickhills
Ultra Champion

It seems to me that you can simplify your scenario a bit:

( cookies<0 AND cookies>=1) means: unless cookies is exactly 0 then its a failure.

If stage is "Not Ready" then your status is "In Progress"

Therefore there are only two conditions you need to test:

| eval Bakes=case(cookies!=0, "Failure", Stages="NotReady", "In Progress")
If my comment helps, please give it a thumbs up!
0 Karma

to4kawa
Ultra Champion
| makeresults count=10
| eval cookies=(random() % 3) - 1, Stages=mvindex(split("NotReady,Ready",","),random() % 2)
| eval Bakes=case(cookies >=1 OR cookies < 0, "Failure", cookies="0" AND Stages!="NotReady", "In Progress",true(), "Failure")
| table cookies Stages Bakes

How about case?

0 Karma

Mary666
Communicator

Thanks so much for your help, would you mind explaining to me the line of code below. I am not sure what the percentages mean, and what the " " supposed to be doing. I accepted your answer for the code right below it. If you can explain this to me that would be awesome. 

| eval cookies=(random() % 3) - 1, Stages=mvindex(split("NotReady,Ready",","),random() % 2)
0 Karma

to4kawa
Ultra Champion

This is the part where the sample data is created.

is modulo operator(https://en.wikipedia.org/wiki/Modulo_operation)

ref: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval#Operators

random() with % creates random "modulo numbers -1".

ref: 

https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/StatisticalFunctions#random.28.29

so, 

| eval cookies=(random() % 3) - 1

makes cookies  -1, 0,  1.

random() % 2

makes 0 ,1.

so, Stages is "NotReady" or "Ready" randomly.

 

 

 

 

0 Karma

Mary666
Communicator

Just a correction, stage should not equal to ---> "NotReady" Therefore, the Stages!="NotReady"

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...