Splunk Search
Highlighted

Help with CASE

Communicator

How do I assign the value "Informational" to the field Severity when the AV Version contains NULL values byu using the Case:

Severity= Informational
AV Version = NULL

eval Severity =case (AV_Version = NULL, "Informational") --> this does not work

PLease advise.. thx

Tags (2)
0 Karma
Highlighted

Re: Help with CASE

SplunkTrust
SplunkTrust

Are you looking for the word NULL in AV_Version or just blank values? If you want to use case then you're missing a couple things... this should work..

eval Severity=case(AV_Version == "NULL", "Informational", AV_Version == "", "Informational")

You can also look at using the isnull() and if() functions...

eval Severity=if(isnull(AV_Version),"Informational",AV_Version)
Highlighted

Re: Help with CASE

Communicator

SOrry, I am looking for blank values.

So, eval Severity=case (AV_Version == "", "Informational") should work??

0 Karma
Highlighted

Re: Help with CASE

SplunkTrust
SplunkTrust

That or you can use the if and isnull combination mentioned ... or you can go as far as to use len() to check the string length, if it's 0 then you know its empty 🙂

0 Karma
Highlighted

Re: Help with CASE

Communicator

Neither of the above mentioned seems to be working..

DO you have example of the len() command?

0 Karma
Highlighted

Re: Help with CASE

SplunkTrust
SplunkTrust

And you are sure the AVVersion field is being extracted and appears in the events even if it's NULL or blank? For len you would just do ... | eval Severity=if(len(AVVersion)==0,"Informational",AV_Version)

0 Karma
Highlighted

Re: Help with CASE

Communicator

That field being extracted is blank...

0 Karma
Highlighted

Re: Help with CASE

SplunkTrust
SplunkTrust

Sorry I dont quite understand... are you confirming the field is being extracted even if it's blank or NULL? If you do just a regular search for null values it returns events? for example: * | where isnull(AV_Version)

0 Karma
Highlighted

Re: Help with CASE

Communicator

Here is the actual search string:

    sourcetype="McAfee ePo - All" |
    sort DAT_Version__VirusScan_Enterprise_ |
    eval AV_Version=DAT_Version__VirusScan_Enterprise_ |
    eval Version_Diff=Current_DAT_Version- 
    DAT_Version__VirusScan_Enterprise_ |
    eval Severity =case(
    DAT_Version__VirusScan_Enterprise_ = 0, "Informational",        
    DAT_Version__VirusScan_Enterprise_ == "", "Informational",
    Version_Diff >= 0 AND Version_Diff <= 5, "Low",
    Version_Diff > 5 AND Version_Diff <= 10, "Medium",
    Version_Diff > 10, "High",
    DAT_Version__VirusScan_Enterprise_ = "N/A", "Informational") |
    table System_Name Last_Communication Current_DAT_Version AV_Version Severity Engine_Version__VirusScan_Enterprise_ 
0 Karma
Highlighted

Re: Help with CASE

SplunkTrust
SplunkTrust

Can you edit your post, highlight the search string you have above and click the code button on the menu bar so that it pastes properly and does not apply automatic formatting.

0 Karma