Help with Splunk search (EVAL command)

[efelder0]

I am trying to assign a value to a Severity field when the sourcetype = "low" or "Med" or "high".

I.e. - IF sourcetype = Low, then Severity = "Low".

I am certain that an EVAL statement should work here, but not sure what the statement would read??

thx

[rtadams89]

This is a prime time to use the eval case() function:

| eval Severity = case(sourcetype == "Low", "Low", sourcetype == "Med", "Medium", sourcetype == "High", "High")

Of course, if the value of the "sourcetype" field is always exactly what you want the value of the "Severity" field to be, you could just do:

| eval Severity = sourcetype

[efelder0 · Accepted solution]

OK, this works now:

eval Severity=if(sourcetype=="Low", "Low", null())

[Flynt]

Excellent, please upvote and accept if this answer helped you.

[efelder0]

I tried that. In fact, here is the actual search string = sourcetype="McAfee ePo - Med" | eval Severity=if(sourcetype=="McAfee ePo - Med", "Medium") | table Severity

I am getting the following error message: [EventsViewer module] Error in 'eval' command: The arguments to the 'if' function are invalid.

[Flynt]

Take out the double "=" inside of your eval and give it another parameter - sourcetype="McAfee ePo - Med" | eval Severity=if(sourcetype="McAfee ePo - Med", "Medium",null) | table Severity

The other parameter can be null if you want nothing or another meaningful result as given in the previous example. If you want to evaluate all three Severity types, the example provided before will nest them into one eval.

[Flynt]

What about something along the lines of

eval Severity = if (sourcetype="low", "low", if (sourcetype="med", "med", if (sourcetype="high", "high","No Status")))