Splunk Dev

Evaluate an if/then expression?

msarro
Builder

Hey everyone. I am trying to create a dashboard; one of the primary items we're looking to create is a composite score of a number of metrics. Basically if item A is below a certain level it is rated 0, if its above a certain level it is rated 1. This is done for a number of items. The items are then totalled, and divided by the number of items to give us an average. How can I do the branch logic in eval statements? Is it possible?

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

There is an if() eval function:

... | eval rating=if(A < level , 0, 1) | ...

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

There is an if() eval function:

... | eval rating=if(A < level , 0, 1) | ...

msarro
Builder

Thanks! I actually found it after some searching. Very much appreciated 🙂

0 Karma
Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...