Splunk Search

How do I edit my if else case eval statement to match my requirement?

rfiscus
Path Finder

How can I case eval this so that:

if Logon_VM is 202-VM-MS, then MICROSOFT
OR
if Logon_VM is 202-VM-BOB, then BOB'S WAFFLES
ELSE
all the rest will be TEST COMPANY.

This all works up until else the rest are TEST COMPANY.

eval Company = case(Logon_VM == "202-VM-MS","MICROSOFT",Logon_VM == "202-VM-BOB","BOB'S WAFFLES",Logon_VM == "B0-202-VM-*","TEST COMPANY")
Tags (4)
1 Solution

rfiscus
Path Finder

I found the answer here, just add any true statement like 1=1, "TEST COMPANY" in the eval statement.

So: eval Company = case(Logon_VM == "202-VM-MS","MICROSOFT",Logon_VM == "202-VM-BOB","BOB'S WAFFLES",1=1,"TEST COMPANY")

View solution in original post

0 Karma

jluo_splunk
Splunk Employee
Splunk Employee

Case uses an if x, then y pattern, and will default to "NULL" if there is no match. You can change the default value by making the last pairing default to true.

Try this:
eval Company = case(Logon_VM == "202-VM-MS","MICROSOFT",Logon_VM == "202-VM-BOB","BOB'S WAFFLES", 1=1,"TEST COMPANY")

0 Karma

lisaac
Path Finder

Thanks for this last example. This is what I was looking for in a separate search.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

1) splunk provides a True() function, which you should use in place of the 1=1.
2) I believe that should be 1==1.

0 Karma

rfiscus
Path Finder

I found the answer here, just add any true statement like 1=1, "TEST COMPANY" in the eval statement.

So: eval Company = case(Logon_VM == "202-VM-MS","MICROSOFT",Logon_VM == "202-VM-BOB","BOB'S WAFFLES",1=1,"TEST COMPANY")

0 Karma

rfiscus
Path Finder
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

1) splunk provides a True() function, which you should use in place of the 1=1.
2) I believe that should be 1==1.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...