Splunk Search

## Eval field based on multiple fields?

Communicator

I have three fields A, B, C. I want to evaluate a field D that has the value of C that corresponds with the min value of B when 0 < B < 4, and A=1. How do I evaluate D? Can I use an eval statement in stats?

Example: if I have the given records with the same ID field,

A=1,B=6,C=2
A=1,B=2,C=3
A=1,B=1,C=5,

Then D=5

Tags (4)
1 Solution
Champion

Given your clarification, I think this should do it (assuming the ID field you mentioned is in a field called `unique_id`😞

``````your base search
| eventstats min(B) AS min_B BY unique_id
| eval D=if(B=min_B AND 0<B AND B<4 AND A=1, C, NULL)
``````
Champion

Given your clarification, I think this should do it (assuming the ID field you mentioned is in a field called `unique_id`😞

``````your base search
| eventstats min(B) AS min_B BY unique_id
| eval D=if(B=min_B AND 0<B AND B<4 AND A=1, C, NULL)
``````
Communicator

Champion

I don't quite understand your description. It sounds like you want D=C if `0<B<4` and `A=1`. But this is true in both of the following lines:

``````A=1,B=2,C=3
A=1,B=1,C=5
``````

So I don't understand how you've determined that D=5 and not D=3. Can you explain?

Communicator

I meant to write the min value of B when 0 < B < 4.

Register for .conf21 Now! Go Vegas or Go Virtual!

### How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20. Learn More or Register Now >

Get Updates on the Splunk Community!