Splunk Search

Eval if function with 2 arguments

bleung93
Path Finder
... | eval totalVolumeGB=if(totalVolumeGB=="0",maxTotalDataSizeMB*23/1024,totalVolumeGB)

How would I add in another argument inside the if function?

I want to apply the above search query in 2 different situations. By including "index=summary_*" and "index!=summary_*" essentially have 2 evals.

I have already tried inserting the following

if(totalVolumeGB=="0" && index=summary_*,maxTotalDataSizeMB*23/1024,totalVolumeGB)

but did not eval correctly. What are some options I can do?

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You cannot use the asterisk character like that, eval interprets it as multiplication and complains about not finding the second factor. Try this:

... | eval totalVolumeGB = if(totalVolumeGB=="0" AND NOT match(index, "^summary_"), maxTotalDataSizeMB*23/1024, totalVolumeGB)

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You cannot use the asterisk character like that, eval interprets it as multiplication and complains about not finding the second factor. Try this:

... | eval totalVolumeGB = if(totalVolumeGB=="0" AND NOT match(index, "^summary_"), maxTotalDataSizeMB*23/1024, totalVolumeGB)

bleung93
Path Finder

This fixed it up. Thanks for the much needed help Martin.

0 Karma

bleung93
Path Finder

I tried following the template in http://answers.splunk.com/answers/101356/and-in-if-statement

| eval totalVolumeGB=if((totalVolumeGB=="0")AND(index!=summary_),maxTotalDataSizeMB*10/1024,totalVolumeGB)
| eval totalVolumeGB=if((totalVolumeGB=="0")AND(index==summary_
),maxTotalDataSizeMB*23/1024,totalVolumeGB)

Got an error banner stating as below...
"Error in 'eval' command: The expression is malformed. An unexpected character is reached at '),maxTotalDataSizeMB*10/1024,totalVolumeGB)'."

0 Karma

bleung93
Path Finder

Resulting into something like this

... | eval totalVolumeGB=if(totalVolumeGB=="0" && index=summary_*,maxTotalDataSizeMB*23/1024,totalVolumeGB)

... | eval totalVolumeGB=if(totalVolumeGB=="0" && index!=summary_*,maxTotalDataSizeMB*10/1024,totalVolumeGB)

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...