Splunk Search

Help in using CASE Statement

Explorer

Hi there,

I want to group the filter into Full Outage or Partial Outage.

filter impact

3G Outage

Full Outage

Cell Blocked

Power Outage

Power OutagePartial Outage

Cell Blocked

 

Here is my query:

| eval impact=case(
searchmatch("Cell Blocked"),"Partial Outage",
searchmatch("3G Outage"),"Full Outage",1=1,"No service impact")

 

Result:

 

result.PNG

 

The correct impact should be Full Outage. Can anyone help me out?

 

Thanks,

Labels (1)
Tags (1)
0 Karma
1 Solution

Ultra Champion

 

| makeresults
| eval filter=split("3G Outage,Cell Blocked,Power Outage",",")
| rename COMMENT as "this is sample"
| rename COMMENT as "the logic"
| eval impact=case(match(filter,"3G Outage"),"Full Outage",match(filter,"Cell Blocked"),"Partial Outage",1=1,"No service impact")

 

filter is multivalue ,searchmatch() works only _raw and case() works in order.
How about this?

View solution in original post

Ultra Champion

 

| makeresults
| eval filter=split("3G Outage,Cell Blocked,Power Outage",",")
| rename COMMENT as "this is sample"
| rename COMMENT as "the logic"
| eval impact=case(match(filter,"3G Outage"),"Full Outage",match(filter,"Cell Blocked"),"Partial Outage",1=1,"No service impact")

 

filter is multivalue ,searchmatch() works only _raw and case() works in order.
How about this?

View solution in original post

Explorer

@to4kawaawesome!

 

| eval impact=case(match(filter,"3G Outage"),"Full Outage",match(filter,"Cell Blocked"),"Partial Outage",1=1,"No service impact")

this works fine for me! Thanks!

Tags (1)
0 Karma