Splunk Search

How do i get and eval statement to add something based on the if statement?

ashidhingra
Path Finder
 | eval hours= if (day="Monday", hours=(a+b), hours)



So basically if day=monday, i wants hours to add up a+b

Labels (3)
0 Karma
1 Solution

mayurr98
Super Champion

hello, what are you trying to achieve? 

 

Could you please give us input and expected output in tabular format. 

 

Isn't it should be 

 

| eval hours=if(day="Mon",hours+2,hours)

View solution in original post

mayurr98
Super Champion

hello, what are you trying to achieve? 

 

Could you please give us input and expected output in tabular format. 

 

Isn't it should be 

 

| eval hours=if(day="Mon",hours+2,hours)

ashidhingra
Path Finder

Nevermind you solved . Thank you so much

0 Karma

ashidhingra
Path Finder

Table
hours day hours2 hours3

null monday 2 5

8 tuesday null null

8 wednesday null null

8 thursday null null

8 friday null null

 

 

If day = monday i want hours to be 2+5

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...