Splunk Search

How to nest an eval in an if statement

Splunkster45
Communicator

Currently I can use a write an if statement in the following form:

...
| eval adjusted_start=start_sum + 1
| eval counter=if(adjusted_start=2,111,555)

where start_sum is a field with a value of either 1 or 2.

However, is there a way to simplify these two lines into one line? I thought the following would work (nesting the eval into the if statement), but either my syntax is off or you can't do it this way.

| eval counter=if(eval(start_sum+1)=2,111,555)

Thanks!

Tags (3)
1 Solution

aweitzman
Motivator

You should be able to do math logic inline:

| eval counter=if(start_sum+1=2,111,555)

View solution in original post

aweitzman
Motivator

You should be able to do math logic inline:

| eval counter=if(start_sum+1=2,111,555)
Get Updates on the Splunk Community!

Transforming Financial Data into Fraud Intelligence

Every day, banks and financial companies handle millions of transactions, logins, and customer interactions ...

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...