Splunk Search

How to check if multiple conditions are true?

iomega311
Explorer

I am looking for a way to check for multiple conditions to match, and if they are met, output a specific word... such as "true".

Example:
my_cool_search_here | eval condition_met=if(user=* AND DoW IN (Mon,Wed) AND HoD IN (01,02,03) AND hostname IN ("hostname.hostdomain","hostname.hostdomain"), "true")

I don't know if that makes sense... but essentially I want to check whether "user" has ANY value, and then if the fields "DoW", "HoD", and "hostname" have specific values out of a possible range.... and if all that matches, then set the value of "condition_met" to "true".

I know I can do this for a single field/value, but how would I accomplish this for multiple different conditions?

Thanks!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
my_cool_search_here | eval condition_met=if(isnotnull(user) AND DoW IN (Mon,Wed) AND HoD IN (01,02,03) AND hostname IN ("hostname.hostdomain","hostname.hostdomain"), "true", null())
0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @iomega311 

as you only want true results, 
please use Case condition and , 

I have updated the query with CASE condition and filed values in qutes 

Query 1 

my_cool_search_here | eval condition_met=case(user="*" AND (DoW="Mon" OR DoW="Wed") AND (HoD="01" OR HoD="02" OR HoD="03") AND (hostname="hostname.hostdomain" OR hostname="hostname.hostdomain"), "true")

OR
Query 2 

my_cool_search_here | eval condition_met=case(user="*" AND DoW IN ("Mon","Wed") AND HoD IN ("01","02","03") AND hostname IN ("hostname.hostdomain","hostname.hostdomain"), "true")

0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...