Splunk Enterprise

Eval and multiple logic operators

jacqu3sy
Path Finder

Hi,

Can anyone explain why the following dosent work?

....
| eval suppress=if((hour >=10 AND hour <=12, "yes","no") AND (dest="x.x.x.x"))
| where suppress="no"
...

the idea being not to produce results if the hour is between 10 - 12 AND the server equals x.x.x.x

I still want to see results produced between 10 - 12 for devices other than that server.

Thanks in advance.

Tags (1)
0 Karma
1 Solution

cmerriman
Super Champion

try this:

| eval suppress=if((hour >=10 AND hour <=12 AND dest="x.x.x.x", "yes","no")
| search suppress="no"

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi
review the eval conditions: you have a condition out ot the condition area, try:

| eval suppress=if(hour>=10 AND hour<=12 AND dest="x.x.x.x", "yes","no") 

In addition I don't like to use >= or <=, I prefer to use only > or <:

| eval suppress=if(hour>9 AND hour<13 AND dest="x.x.x.x", "yes","no") 

Bye.
Giuseppe

0 Karma

jacqu3sy
Path Finder

thanks for that.

0 Karma

cmerriman
Super Champion

try this:

| eval suppress=if((hour >=10 AND hour <=12 AND dest="x.x.x.x", "yes","no")
| search suppress="no"
0 Karma

jacqu3sy
Path Finder

thanks, worked perfect.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...