Splunk Search

Help with eval (if)

Communicator

I need some assistance with the eval (if) function. I have a CSV file that has been indexed with 100 records. In that CSV, there is a field (fieldX) that has values ranging 1-100. In my output, I only want to return records where fieldX is greater than or equal to 4.

I think the eval with IF function would work here. Maybe something like eval field1=if(fieldX <= 4, "1", "0")

Any suggestions would greatly be appreciated.

thx

Tags (1)
0 Karma
1 Solution

Legend

Not sure if you actually need to use eval - if you only want to include the results where fieldX is greater than or equal to 4, couldn't you include it as a regular search filter?

... | search fieldX>=4

View solution in original post

Legend

Not sure if you actually need to use eval - if you only want to include the results where fieldX is greater than or equal to 4, couldn't you include it as a regular search filter?

... | search fieldX>=4

View solution in original post

Communicator

yes, that seems to work fine. Thanks!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!