Eval Case Formula

[jackreeves]

Hi,

Struggling to complete an Eval Case syntax. I want to create a situation where I have a new field called provider based on certain criteria.

Provider:
XYZ (if D1_Code equals X and current team does not equal ABC or DEF)
ABC (if current team equals ABC) - wildcards needed as there are variants of ABC
DEF (if current team equals DEF) - wildcards needed as there are variants of DEF

Search string is | eval Provider=case(D1_Code="X" AND Current_Team!="ABC" AND Current_Team!="DEF", "XYZ", Current_Team="ABC", "ABC", Current_Team="DEF", "DEF")

The first part of the eval works on it's own but when I try and add criteria for ABC and DEF it will not work.
Provider=case(D1_Code="X" AND Current_Team!="ABC" AND Current_Team!="DEF")

Could anyone please advice? Not sure if case is the right thing to use here.

Thanks in advance

[s2_splunk]

This works for me: | makeresults | eval D1_Code="X", Current_Team="DEF" | eval Provider=case( (D1_Code="X" AND Current_Team!="ABC" AND Current_Team!="DEF"), "XYZ", Current_Team="ABC", "ABC", Current_Team="DEF", "DEF")

[somesoni2]

How about you change the order, like this...

....| eval Provider=case(Current_Team="ABC", "ABC", Current_Team="DEF", "DEF",D1_Code="X", "XYZ")

Also, if you want to match with wildcards (you need to provide actual sample values for better suggestions), try this

....| eval Provider=case(match(Current_Team,"ABC"), "ABC", match(Current_Team,"DEF"), "DEF",D1_Code="X", "XYZ")

[adonio · Accepted solution]

great answer here:
https://answers.splunk.com/answers/170602/how-would-i-use-eval-with-a-wildcard-to-create-a-c.html

[jackreeves]

Brilliant - this solved the issue!

Many thanks

[adonio]

converted to answer, if it worked for you, please accept it and mark as answered