Eval if function with 2 arguments

[bleung93]

... | eval totalVolumeGB=if(totalVolumeGB=="0",maxTotalDataSizeMB*23/1024,totalVolumeGB)

How would I add in another argument inside the if function?

I want to apply the above search query in 2 different situations. By including "index=summary_*" and "index!=summary_*" essentially have 2 evals.

I have already tried inserting the following

if(totalVolumeGB=="0" && index=summary_*,maxTotalDataSizeMB*23/1024,totalVolumeGB)

but did not eval correctly. What are some options I can do?

[martin_mueller · Accepted solution]

You cannot use the asterisk character like that, eval interprets it as multiplication and complains about not finding the second factor. Try this:

... | eval totalVolumeGB = if(totalVolumeGB=="0" AND NOT match(index, "^summary_"), maxTotalDataSizeMB*23/1024, totalVolumeGB)

[bleung93]

This fixed it up. Thanks for the much needed help Martin.

[bleung93]

I tried following the template in http://answers.splunk.com/answers/101356/and-in-if-statement

| eval totalVolumeGB=if((totalVolumeGB=="0")AND(index!=summary_),maxTotalDataSizeMB*10/1024,totalVolumeGB)
| eval totalVolumeGB=if((totalVolumeGB=="0")AND(index==summary_),maxTotalDataSizeMB*23/1024,totalVolumeGB)

Got an error banner stating as below...
"Error in 'eval' command: The expression is malformed. An unexpected character is reached at '),maxTotalDataSizeMB*10/1024,totalVolumeGB)'."

[bleung93]

Resulting into something like this

... | eval totalVolumeGB=if(totalVolumeGB=="0" && index=summary_*,maxTotalDataSizeMB*23/1024,totalVolumeGB)

... | eval totalVolumeGB=if(totalVolumeGB=="0" && index!=summary_*,maxTotalDataSizeMB*10/1024,totalVolumeGB)