Splunk Search

Help with Splunk search (EVAL command)

efelder0
Communicator

I am trying to assign a value to a Severity field when the sourcetype = "low" or "Med" or "high".

I.e. - IF sourcetype = Low, then Severity = "Low".

I am certain that an EVAL statement should work here, but not sure what the statement would read??

thx

Tags (1)
1 Solution

efelder0
Communicator

OK, this works now:

eval Severity=if(sourcetype=="Low", "Low", null())

View solution in original post

rtadams89
Contributor

This is a prime time to use the eval case() function:

| eval Severity = case(sourcetype == "Low", "Low", sourcetype == "Med", "Medium", sourcetype == "High", "High")

Of course, if the value of the "sourcetype" field is always exactly what you want the value of the "Severity" field to be, you could just do:

| eval Severity = sourcetype

efelder0
Communicator

OK, this works now:

eval Severity=if(sourcetype=="Low", "Low", null())

Flynt
Splunk Employee
Splunk Employee

Excellent, please upvote and accept if this answer helped you.

0 Karma

efelder0
Communicator

I tried that. In fact, here is the actual search string = sourcetype="McAfee ePo - Med" | eval Severity=if(sourcetype=="McAfee ePo - Med", "Medium") | table Severity

I am getting the following error message: [EventsViewer module] Error in 'eval' command: The arguments to the 'if' function are invalid.

Flynt
Splunk Employee
Splunk Employee

Take out the double "=" inside of your eval and give it another parameter - sourcetype="McAfee ePo - Med" | eval Severity=if(sourcetype="McAfee ePo - Med", "Medium",null) | table Severity

The other parameter can be null if you want nothing or another meaningful result as given in the previous example. If you want to evaluate all three Severity types, the example provided before will nest them into one eval.

0 Karma

Flynt
Splunk Employee
Splunk Employee

What about something along the lines of

eval Severity = if (sourcetype="low", "low", if (sourcetype="med", "med", if (sourcetype="high", "high","No Status")))

Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...