Splunk Enterprise

Eval and multiple logic operators

jacqu3sy
Path Finder

Hi,

Can anyone explain why the following dosent work?

....
| eval suppress=if((hour >=10 AND hour <=12, "yes","no") AND (dest="x.x.x.x"))
| where suppress="no"
...

the idea being not to produce results if the hour is between 10 - 12 AND the server equals x.x.x.x

I still want to see results produced between 10 - 12 for devices other than that server.

Thanks in advance.

Tags (1)
0 Karma
1 Solution

cmerriman
Super Champion

try this:

| eval suppress=if((hour >=10 AND hour <=12 AND dest="x.x.x.x", "yes","no")
| search suppress="no"

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi
review the eval conditions: you have a condition out ot the condition area, try:

| eval suppress=if(hour>=10 AND hour<=12 AND dest="x.x.x.x", "yes","no") 

In addition I don't like to use >= or <=, I prefer to use only > or <:

| eval suppress=if(hour>9 AND hour<13 AND dest="x.x.x.x", "yes","no") 

Bye.
Giuseppe

0 Karma

jacqu3sy
Path Finder

thanks for that.

0 Karma

cmerriman
Super Champion

try this:

| eval suppress=if((hour >=10 AND hour <=12 AND dest="x.x.x.x", "yes","no")
| search suppress="no"
0 Karma

jacqu3sy
Path Finder

thanks, worked perfect.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...