Splunk Search

Eval Case Statement Help

Engager

I would like to put a case statement under the values in the attached image.
I tried something along the lines of eval score=case(count* < 80 , 1)
but that did not work.
alt text

Tags (2)
0 Karma

SplunkTrust
SplunkTrust

Assuming you want to set score=1 if any field is below 80, try this:

... | eval score = 0 | foreach count* [eval score = max(if('<<FIELD>>' < 80, 1, 0), score)]

Assuming you want to set score=1 if all fields are below 80, try this:

... | eval score = 1 | foreach count* [eval score = min(if('<<FIELD>>' >= 80, 0, 1), score)]
0 Karma

SplunkTrust
SplunkTrust

So you want a score of 1 if every count* field is less than 80?

0 Karma