Splunk Search

How to modify output based on condition applied to each rows

ibob0304
Communicator

I have a query that output below, Status column is generated based on if condition.

|eval Status = if(Quantity>10,Good,BAD)

Output

Name           Quantity           Status
pen                20              Good    
book               13              Good
riddle             2               Bad
note               60              Good

Is it possible to apply if or any other conditions to each row ? like if pen Quantity is more than 1 then say Good,
if book Quantity is less than 10 is Bad ?. In short, applying conditions to each row instead of applying at one column level.

0 Karma
1 Solution

mayurr98
Super Champion

Yes you can are caseif you are looking for applying conditions to each row

You can try something like

...|eval Status=case(Name="pen" AND Quantity>1,"Good",Name="book" AND Quantity<10,"Bad")

In this way you can add condition for other rows as well i.e. for riddle note and so on.

let me know if this helps!

View solution in original post

mayurr98
Super Champion

Yes you can are caseif you are looking for applying conditions to each row

You can try something like

...|eval Status=case(Name="pen" AND Quantity>1,"Good",Name="book" AND Quantity<10,"Bad")

In this way you can add condition for other rows as well i.e. for riddle note and so on.

let me know if this helps!

ibob0304
Communicator

That worked.. Thank you

0 Karma

493669
Super Champion

You can try like:

...|eval Status=if (Name="pen" AND Quantity >1 ,"Good", "Bad")
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...