How do I do a nested if statement?

[jitin_ratra]

I am trying to use multiple ifs within the eval but the query seems to throw an error.

What i want to do is use TTI if it's greater than 0. Otherwise, I'd use TTIVR if FCP!=0

This is what i tried so far
| eval test=if( TTI > 0, TTI, if(FCP!=0,TTIVR))

[kamlesh_vaghela]

@jitin_ratra

You can try case also.

YOUR_SEARCH
| eval test=case( TTI>0, TTI, FCP!=0,TTIVR)

Sample Search:

| makeresults 
| eval TTI=100,FCP=0,TTIVR =100
| eval test=case( TTI>0, TTI, FCP!=0,TTIVR)

http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/ConditionalFunctions#case.28X.2C.2...

[Vijeta · Accepted solution]

Use this code , as you need to specify the value if FCP!=0 condition is false therefore I have placed null( can be any other value like " ")

|eval test=if(TTI > 0, TTI,if(FCP!=0,TTIVR,null))