Splunk Search
Highlighted

Eval Case Formula

Explorer

Hi,

Struggling to complete an Eval Case syntax. I want to create a situation where I have a new field called provider based on certain criteria.

Provider:
XYZ (if D1_Code equals X and current team does not equal ABC or DEF)
ABC (if current team equals ABC) - wildcards needed as there are variants of ABC
DEF (if current team equals DEF) - wildcards needed as there are variants of DEF

Search string is | eval Provider=case(D1Code="X" AND CurrentTeam!="ABC" AND CurrentTeam!="DEF", "XYZ", CurrentTeam="ABC", "ABC", Current_Team="DEF", "DEF")

The first part of the eval works on it's own but when I try and add criteria for ABC and DEF it will not work.
Provider=case(D1Code="X" AND CurrentTeam!="ABC" AND Current_Team!="DEF")

Could anyone please advice? Not sure if case is the right thing to use here.

Thanks in advance

0 Karma
Highlighted

Re: Eval Case Formula

Explorer

Brilliant - this solved the issue!

Many thanks

0 Karma
Highlighted

Re: Eval Case Formula

SplunkTrust
SplunkTrust

converted to answer, if it worked for you, please accept it and mark as answered

0 Karma
Highlighted

Re: Eval Case Formula

SplunkTrust
SplunkTrust

How about you change the order, like this...

....| eval Provider=case(Current_Team="ABC", "ABC", Current_Team="DEF", "DEF",D1_Code="X", "XYZ")

Also, if you want to match with wildcards (you need to provide actual sample values for better suggestions), try this

....| eval Provider=case(match(Current_Team,"ABC"), "ABC", match(Current_Team,"DEF"), "DEF",D1_Code="X", "XYZ")
0 Karma
Highlighted

Re: Eval Case Formula

Influencer

This works for me: | makeresults | eval D1_Code="X", Current_Team="DEF" | eval Provider=case( (D1_Code="X" AND Current_Team!="ABC" AND Current_Team!="DEF"), "XYZ", Current_Team="ABC", "ABC", Current_Team="DEF", "DEF")

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.