Splunk Search

Eval function as result of IF statement

balcv
Contributor

Is it possible to have the true and false parts of an if statement contain eval statements.

 

 

| eval pwdExpire=if(type="staff", |  eval relative_time(_time, "+90day") , |  eval relative_time(_time, "+180day") ) 

 

 

Desired results is:
If type="staff" calculate pwdExpiry as _time + 90 days, else calculate pwdExpiry as _time + 180 days.

I will then format pwdExpiry and display in a table.

Labels (1)
0 Karma
1 Solution

chris_barrett
SplunkTrust
SplunkTrust

The following should do what you want:

| eval pwdExpire = if(type="staff", strftime(relative_time(_time, "+90d"),"%F %T"), strftime(relative_time(_time, "+180d"),"%F %T") )

 

You may need to adjust the time format (I've used %F %T) to suit your requirements.

View solution in original post

chris_barrett
SplunkTrust
SplunkTrust

The following should do what you want:

| eval pwdExpire = if(type="staff", strftime(relative_time(_time, "+90d"),"%F %T"), strftime(relative_time(_time, "+180d"),"%F %T") )

 

You may need to adjust the time format (I've used %F %T) to suit your requirements.

PickleRick
SplunkTrust
SplunkTrust

One additional remark about time manipulation - don't render it to a string unless you are absolutely sure you won't be doing anything else with it. And even better - don't render the _value_ to a string - leave the value in an epoch timestamp but use fieldformat command to only display it rendered to a string.

balcv
Contributor

Perfect @chris_barrett .  Thanks for the response.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...