Splunk Search

Eval if function with 2 arguments

bleung93
Path Finder
... | eval totalVolumeGB=if(totalVolumeGB=="0",maxTotalDataSizeMB*23/1024,totalVolumeGB)

How would I add in another argument inside the if function?

I want to apply the above search query in 2 different situations. By including "index=summary_*" and "index!=summary_*" essentially have 2 evals.

I have already tried inserting the following

if(totalVolumeGB=="0" && index=summary_*,maxTotalDataSizeMB*23/1024,totalVolumeGB)

but did not eval correctly. What are some options I can do?

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You cannot use the asterisk character like that, eval interprets it as multiplication and complains about not finding the second factor. Try this:

... | eval totalVolumeGB = if(totalVolumeGB=="0" AND NOT match(index, "^summary_"), maxTotalDataSizeMB*23/1024, totalVolumeGB)

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You cannot use the asterisk character like that, eval interprets it as multiplication and complains about not finding the second factor. Try this:

... | eval totalVolumeGB = if(totalVolumeGB=="0" AND NOT match(index, "^summary_"), maxTotalDataSizeMB*23/1024, totalVolumeGB)

bleung93
Path Finder

This fixed it up. Thanks for the much needed help Martin.

0 Karma

bleung93
Path Finder

I tried following the template in http://answers.splunk.com/answers/101356/and-in-if-statement

| eval totalVolumeGB=if((totalVolumeGB=="0")AND(index!=summary_),maxTotalDataSizeMB*10/1024,totalVolumeGB)
| eval totalVolumeGB=if((totalVolumeGB=="0")AND(index==summary_
),maxTotalDataSizeMB*23/1024,totalVolumeGB)

Got an error banner stating as below...
"Error in 'eval' command: The expression is malformed. An unexpected character is reached at '),maxTotalDataSizeMB*10/1024,totalVolumeGB)'."

0 Karma

bleung93
Path Finder

Resulting into something like this

... | eval totalVolumeGB=if(totalVolumeGB=="0" && index=summary_*,maxTotalDataSizeMB*23/1024,totalVolumeGB)

... | eval totalVolumeGB=if(totalVolumeGB=="0" && index!=summary_*,maxTotalDataSizeMB*10/1024,totalVolumeGB)

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...