Splunk Search

Eval function as result of IF statement

balcv
Contributor

Is it possible to have the true and false parts of an if statement contain eval statements.

 

 

| eval pwdExpire=if(type="staff", |  eval relative_time(_time, "+90day") , |  eval relative_time(_time, "+180day") ) 

 

 

Desired results is:
If type="staff" calculate pwdExpiry as _time + 90 days, else calculate pwdExpiry as _time + 180 days.

I will then format pwdExpiry and display in a table.

Labels (1)
0 Karma
1 Solution

chris_barrett
SplunkTrust
SplunkTrust

The following should do what you want:

| eval pwdExpire = if(type="staff", strftime(relative_time(_time, "+90d"),"%F %T"), strftime(relative_time(_time, "+180d"),"%F %T") )

 

You may need to adjust the time format (I've used %F %T) to suit your requirements.

View solution in original post

chris_barrett
SplunkTrust
SplunkTrust

The following should do what you want:

| eval pwdExpire = if(type="staff", strftime(relative_time(_time, "+90d"),"%F %T"), strftime(relative_time(_time, "+180d"),"%F %T") )

 

You may need to adjust the time format (I've used %F %T) to suit your requirements.

PickleRick
SplunkTrust
SplunkTrust

One additional remark about time manipulation - don't render it to a string unless you are absolutely sure you won't be doing anything else with it. And even better - don't render the _value_ to a string - leave the value in an epoch timestamp but use fieldformat command to only display it rendered to a string.

balcv
Contributor

Perfect @chris_barrett .  Thanks for the response.

0 Karma
Get Updates on the Splunk Community!

Let’s Talk Terraform

If you’re beyond the first-weeks-of-a-startup stage, chances are your application’s architecture is pretty ...

Cloud Platform | Customer Change Announcement: Email Notification is Available For ...

The Notification Team is migrating our email service provider. As the rollout progresses, Splunk has enabled ...

Save the Date: GovSummit Returns Wednesday, December 11th!

Hey there, Splunk Community! Exciting news: Splunk’s GovSummit 2024 is returning to Washington, D.C. on ...