Splunk Search

How to compare nested case statements with eval

anu1729
Loves-to-Learn Lots

Hi,

I am trying to use case keyword to solve a multiple nested statement  but it is just giving me output for the else value, it seems like it is not going inside any other statement to check, Could anyone please help me here. I tired using multiple if statement with eval still I was having the same issue.

Problem statement : I want to compare the value of status-fail and status-success and on the basis of that we need to generate the output

case1 : if value of status-fail =0 and status-success>0 ---> successful logins

case2: if value of status-fail >0 and status-success>0 --->  multi-successful logins

case3: if value of status-fail >0 and status-success=0 ---> multi-fail

case4: if value of status-fail >0  ---> fail logins

Below is the query what I am using :

table hqid, httpStatus | eval status-success=if(httpStatus="200",1,0) | eval status-fail= if(httpStatus != "200",1,0)
| stats sum(status-success) as status-success, sum(status-fail) as status-fail by hqid | eval status = case(status-fail = 0 AND status-success > 0, "successful-logins", status-fail > 0 AND status-success > 0, "multi-success", status-fail > 0 AND status-success=0, "multi-fail", status-fail > 0, "fail",1=1,"Others")

Labels (1)
Tags (1)
0 Karma

anu1729
Loves-to-Learn Lots

Thank you , its working now.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try putting the field names with hyphens in in single quotes - something like this (or use fieldnames without hyphens!)

table hqid, httpStatus | eval status-success=if(httpStatus="200",1,0) | eval status-fail= if(httpStatus != "200",1,0)
| stats sum(status-success) as status-success, sum(status-fail) as status-fail by hqid | eval status = case('status-fail' = 0 AND 'status-success' > 0, "successful-logins", 'status-fail' > 0 AND 'status-success' > 0, "multi-success", 'status-fail' > 0 AND 'status-success'=0, "multi-fail", 'status-fail' > 0, "fail",1=1,"Others")
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...