Splunk Search

How to nest an eval in an if statement

Splunkster45
Communicator

Currently I can use a write an if statement in the following form:

...
| eval adjusted_start=start_sum + 1
| eval counter=if(adjusted_start=2,111,555)

where start_sum is a field with a value of either 1 or 2.

However, is there a way to simplify these two lines into one line? I thought the following would work (nesting the eval into the if statement), but either my syntax is off or you can't do it this way.

| eval counter=if(eval(start_sum+1)=2,111,555)

Thanks!

Tags (3)
1 Solution

aweitzman
Motivator

You should be able to do math logic inline:

| eval counter=if(start_sum+1=2,111,555)

View solution in original post

aweitzman
Motivator

You should be able to do math logic inline:

| eval counter=if(start_sum+1=2,111,555)
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...