Splunk Search

Correct syntax of eval string case

itnewbie
Explorer

I have a "Severity Level" field in both index A and index B.


Their structure is like:

 

 

==index A===
Severity Level
1
2
3
4

===index B===
Severity Level
critical
high
medium
low

 

 

 Now I want to combine the two indexes in a search and display the Severity Level using 

 

 

| timechart count by "Severity Level"

 

 

where the combined "Severity Level" values only contain 1,2,3,4

So, I need an eval = case() to map them.

My syntax for for that is 

 

 

eval "Severity Level" = case('Severity Level' == "critical", 1 ,'Severity Level' == "high", 2, 'Severity Level' == "medium", 3, 'Severity Level' == "low", 4, 'Severity Level' == 1, 1, 'Severity Level'  == 2, 2, 'Severity Level'  == 3, 3, 'Severity Level'  == 4, 4, 1=1, null)

 

 

 By this, the result gives incorrect result, i.e., only showing incorrect counts on 4. I think the problem is in the single and double quote, but I am not sure which is which. It is a bit urgent so I need help. Thanks. 

Labels (2)
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

There doesn't appear to be anything functionally wrong with the case. With eval, you MUST use single quotes to wrap field names on the RIGHT hand side of the eval, whereas double quotes are used on the LEFT hand side, i.e.

| eval "Severity Level" = case('Severity Level'...)

As you have

This shows your eval is correct

| makeresults 
| eval "Severity Level"=split("1,2,3,4", ",") 
| mvexpand "Severity Level" 
| append 
    [| makeresults 
    | eval "Severity Level"=split("critical,high,medium,low", ",") 
    | mvexpand "Severity Level"
        ] 
| fields - _time 
| eval "Severity Level" = case('Severity Level' == "critical", 1 ,'Severity Level' == "high", 2, 'Severity Level' == "medium", 3, 'Severity Level' == "low", 4, 'Severity Level' == 1, 1, 'Severity Level' == 2, 2, 'Severity Level' == 3, 3, 'Severity Level' == 4, 4, 1=1, null)

but you could just do

| eval "Severity Level" = case('Severity Level' == "critical", 1,
                               'Severity Level' == "high", 2, 
                               'Severity Level' == "medium", 3, 
                               'Severity Level' == "low", 4, 1==1, 'Severity Level')

as the final case statement is just saying that it will take the value of Severity Level - unless you may have some other value.

 

View solution in original post

jotne
Builder

A small tip:

| makeresults 
| eval "Severity Level"=split("1,2,3,4", ",") 
| mvexpand "Severity Level" 

Can also be created like this:

| makeresults count=4
| streamstats count as "Severity Level"

bowesmana
SplunkTrust
SplunkTrust

There doesn't appear to be anything functionally wrong with the case. With eval, you MUST use single quotes to wrap field names on the RIGHT hand side of the eval, whereas double quotes are used on the LEFT hand side, i.e.

| eval "Severity Level" = case('Severity Level'...)

As you have

This shows your eval is correct

| makeresults 
| eval "Severity Level"=split("1,2,3,4", ",") 
| mvexpand "Severity Level" 
| append 
    [| makeresults 
    | eval "Severity Level"=split("critical,high,medium,low", ",") 
    | mvexpand "Severity Level"
        ] 
| fields - _time 
| eval "Severity Level" = case('Severity Level' == "critical", 1 ,'Severity Level' == "high", 2, 'Severity Level' == "medium", 3, 'Severity Level' == "low", 4, 'Severity Level' == 1, 1, 'Severity Level' == 2, 2, 'Severity Level' == 3, 3, 'Severity Level' == 4, 4, 1=1, null)

but you could just do

| eval "Severity Level" = case('Severity Level' == "critical", 1,
                               'Severity Level' == "high", 2, 
                               'Severity Level' == "medium", 3, 
                               'Severity Level' == "low", 4, 1==1, 'Severity Level')

as the final case statement is just saying that it will take the value of Severity Level - unless you may have some other value.

 

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...