Splunk Search

## Can I do a calculation inside an IF statement's True condition?

Engager

I need to find the power consumption of each day using the cumulative power meter reading;

However, the meter reading resets after it reaches 999, 999. Thus, if the meter reading resets, the consumption will appear as a large negative value. To get the correct value, I will have to add 1,000,000 (as 0 is a count as well).

I am very used to C programming and new to Splunk so please forgive me. This is the line I came up with:
`eval Diff=if (Diff<0, Diff=Diff+10000000, Diff)`

The value of Diff disappears completely for the day that reset occurs. I do realize that calculations are not exactly allowed inside an IF statement, but may I know how to go around it?

1 Solution
Legend

@khinnway ,

Yes it's possible to do calculation in condition. Please find below a dummy search . The result should be 0

``````|makeresults|eval Diff=-100|eval Diff=if(Diff<0,Diff+100,Diff)
``````

---
What goes around comes around. If it helps, hit it with Karma 🙂
Legend

@khinnway ,

Yes it's possible to do calculation in condition. Please find below a dummy search . The result should be 0

``````|makeresults|eval Diff=-100|eval Diff=if(Diff<0,Diff+100,Diff)
``````

---
What goes around comes around. If it helps, hit it with Karma 🙂
Engager

Thank you so much for the help! I really appreciate the fast comment!

Get Updates on the Splunk Community!

#### .conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

#### Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

#### Troubleshooting the OpenTelemetry Collector

In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...