Splunk Search

Can you help me write an eval case function search?

New Member

I am looking for help with a case statement that looks for a field full load with a value of "running CDC only in fresh start mode, starting from log position: 'timestamp:", and if full load doesn't find that then other is used.

index=sse_gdia_local_idx "starting from log" |eval fullload = case("running CDC only in fresh start mode, starting from log position: 'timestamp:",
trim(replace(fullload, "running CDC only in fresh start mode, starting from log position: 'timestamp:","")) and

trim(replace(fullload, "T", " ")) and trim(replace(fullload, "'", " ")) and |eval c_time2=strptime(fullload,"%Y-%m-%d %H:%M:%S")
-14400 and c_time2 = strftime(c_time2,"%Y-%m-%d %H:%M:%S"),
other|convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) AS c_time2) |fields fullload, c_time2

0 Karma

Splunk Employee
Splunk Employee

Hi @rgarbac1,
Here's some info from the Splunk docs: http://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/ConditionalFunctions
Description:This function takes pairs of arguments X and Y. The X arguments are Boolean expressions that are evaluated from first to last. When the first X expression is encountered that evaluates to TRUE, the corresponding Y argument is returned. The function defaults to NULL if none are true.
Usage: You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions.
Basic examples
The following example returns descriptions for the corresponding http status code.

... | eval description=case(error ==404, "Not found", error == 500,
"Internal Server Error", error == 200, "OK")

From a cursory glance and without being a Splunk expert (I'm a community post moderator), it does look like the syntax is off where X should be without quotes and y should have quotes: case(X,"Y",...)
Hope that helps! I added some tags for more expert visibility too. 🙂

Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of Splunk APM’s and Splunk RUM’s streaming infrastructure in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...