Splunk Enterprise

How to set a Field Value to "True OR False" based on other Field value

beriwalnishant
Path Finder

Hi Team,

I have a situation where I need to base a field value in the normal search query on 'true' or 'false' based on another field

example :

index=xxx host=xxx sourcetype=xxx productcode="RE" countryid="74321" 

what I need is that if the field 'countryid' is equal to '74321' the other field 'foundincache' set to only 'false' if not it should be set to 'true'


I tried something like this but it doesnt take the value from 'inscache'.  I mean inscache is not working as a variable 

index=xxx host=xxx sourcetype=xxx productcode="RE" countryid="74321" 
| eval countryid="70207"
| eval inscache=if(countryid=="70207","false","true")
| search foundincache=inscache
| stats count by foundincache

Is there a way to do it I tried google search etc but cant find this anywhere

Many thanks in adavance 
Nishant


 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Search doesn't work with variables on the right hand side of evaluations, use the where command instead

| where foundincache==inscache

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Search doesn't work with variables on the right hand side of evaluations, use the where command instead

| where foundincache==inscache

beriwalnishant
Path Finder

OMG, this is truly amazing, incredible, superb.

I had no idea it be that simple.

 

thanks thanks thanks and thanks a lot @ITWhisperer 

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...