- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
cbiraris
Path Finder
11-07-2024
03:51 AM
Can you please help me to build eval query
Condition-1
ABC=Match
XYZ=Match
then output of ABC compare to XYZ is Match
Condition-2
ABC=Match
XYZ=NO_Match
then output of ABC compare to XYZ is No_Match
Condition-3
ABC=NO_Match
XYZ=Match
then output of ABC compare to XYZ is No_Match
Condition-4
ABC=NO_Match
XYZ=NO_Match
then output of ABC compare to XYZ is No_Match
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
11-07-2024
04:47 AM
| eval output=if(ABC="NO_Match" OR XYZ="NO_Match", "NO_Match", "Match")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
11-07-2024
04:47 AM
| eval output=if(ABC="NO_Match" OR XYZ="NO_Match", "NO_Match", "Match")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
cbiraris
Path Finder
11-07-2024
04:53 AM
Thank you, its working
