Splunk Search

Help in using CASE Statement

Noob_splunker
Explorer

Hi there,

I want to group the filter into Full Outage or Partial Outage.

filter impact

3G Outage

Full Outage

Cell Blocked

Power Outage

Power OutagePartial Outage

Cell Blocked

 

Here is my query:

| eval impact=case(
searchmatch("Cell Blocked"),"Partial Outage",
searchmatch("3G Outage"),"Full Outage",1=1,"No service impact")

 

Result:

 

result.PNG

 

The correct impact should be Full Outage. Can anyone help me out?

 

Thanks,

Labels (1)
Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion

 

| makeresults
| eval filter=split("3G Outage,Cell Blocked,Power Outage",",")
| rename COMMENT as "this is sample"
| rename COMMENT as "the logic"
| eval impact=case(match(filter,"3G Outage"),"Full Outage",match(filter,"Cell Blocked"),"Partial Outage",1=1,"No service impact")

 

filter is multivalue ,searchmatch() works only _raw and case() works in order.
How about this?

View solution in original post

to4kawa
Ultra Champion

 

| makeresults
| eval filter=split("3G Outage,Cell Blocked,Power Outage",",")
| rename COMMENT as "this is sample"
| rename COMMENT as "the logic"
| eval impact=case(match(filter,"3G Outage"),"Full Outage",match(filter,"Cell Blocked"),"Partial Outage",1=1,"No service impact")

 

filter is multivalue ,searchmatch() works only _raw and case() works in order.
How about this?

Noob_splunker
Explorer

@to4kawaawesome!

 

| eval impact=case(match(filter,"3G Outage"),"Full Outage",match(filter,"Cell Blocked"),"Partial Outage",1=1,"No service impact")

this works fine for me! Thanks!

Tags (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...