Splunk Enterprise

conditional statements based on values with eval

shivareddysompa
Explorer

i have date like below.

User                        Points gain

a                                 1004

b                                  900

c                                  850

d                                  700

e                                  600

i want to create new column based on Points gain like

if User got > 1000 then Expert, 850 to 1000 then Master, 700 to 850 average , <700 Slow 

 

Thanks

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can do that with eval and case.

... | eval rank=case('Points gain'>1000, "Expert", 'Points gain'>=850, "Master", 'Points gain'>=700, "average", 1==1, "Slow")

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

shivareddysompa
Explorer

i tried same but not worked out here

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It works here.  What version of Splunk are you using?

| makeresults 
| eval _raw="User                        Points gain
a                                 1004
b                                  900
c                                  850
d                                  700
e                                  600" | multikv forceheader=1 | rename gain as "Points gain"
`comment("Above creates test data")`
| eval rank=case('Points gain'>1000, "Expert", 'Points gain'>=850, "Master", 'Points gain'>=700, "average", 1==1, "Slow")
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...