Splunk Enterprise

How could I get multiple result when using "case"?

Questioner
Path Finder

I want to show this requirement in splunk.

  • when year<="2020" &&  time_type = "ALL" make variable "day_type" must have "day"
  • when year>"2020" &&  time_type = "ALL" make variable  "day_type" can have "day" and "night"
  • when time_type="half" make variable "day_type" must have "morning"

So, I wrote my code like this, but it doesn't working at all.

where day_type = case("$time_type$"=="ALL", case("$year$"<="2020", "day",1=1, in("day","night")), "$time_type$"=="half", "morning", 1=1,day_type)

 How could I make this Requirement ??

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Are you trying to filter your events based on the values in these fields?

| where (year<=2020 AND time_type=="ALL" AND day_type=="day") OR (year>2020 AND time_type="ALL" AND (day_type=="day" OR day_type=="night")) OR (time_type=="half" AND day_type=="morning")

View solution in original post

0 Karma

Manasa_401
Communicator

Hi @Questioner 

First using an eval create a day_type field with the conditions and next you can use where command to filter for the day_type you need.

| eval day_type=case(time_type="ALL" AND year<=2020,"day",time_type = "ALL" AND year>2020,"day night",1=1,"morning")
| where like(day_type,"%day%")

 You can pass the token in where command

 

If this answer helps, an upvote would be appreciated.

0 Karma

Questioner
Path Finder

But it cound not recognized " like(day_type, "%day")"
It said the expression is malformed.😢

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are you trying to filter your events based on the values in these fields?

| where (year<=2020 AND time_type=="ALL" AND day_type=="day") OR (year>2020 AND time_type="ALL" AND (day_type=="day" OR day_type=="night")) OR (time_type=="half" AND day_type=="morning")
0 Karma

Questioner
Path Finder

I never thought of it this way.

Thank you for your information!!

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...