Splunk Search

How to compare and calculate comparison flag for two fields

mbasharat
Builder

Hi, 

I have below scenario. My brain is very slow at this time of the day!

I need an eval to create Status field as in the table below that will flag a host if it is running on IPv4 OR IPv6 OR both IPv4 +IPv6

HOSTNAMEIPv4IPv6Status
SampleA0.0.0.1 IPv4
SampleB 0.0.0.2IPv6
SampleC0.0.0.3A:B:C:D:E:FIPv4 + IPv6


Thanks in-advance!!!

Labels (5)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There may be a few ways to do that.  Here's one.

| eval Status = case(isnotnull(IPv4) AND isnotnull(IPv6), "IPv4 + IPv6",
                     isnotnull(IPv4), "IPv4",
                     isnotnull(IPv6), "IPv6",
                     1==1, "")
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

mbasharat
Builder

Thanks @richgalloway!!

richgalloway
SplunkTrust
SplunkTrust

There may be a few ways to do that.  Here's one.

| eval Status = case(isnotnull(IPv4) AND isnotnull(IPv6), "IPv4 + IPv6",
                     isnotnull(IPv4), "IPv4",
                     isnotnull(IPv6), "IPv6",
                     1==1, "")
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...