Splunk Search

How to nest an eval in an if statement

Splunkster45
Communicator

Currently I can use a write an if statement in the following form:

...
| eval adjusted_start=start_sum + 1
| eval counter=if(adjusted_start=2,111,555)

where start_sum is a field with a value of either 1 or 2.

However, is there a way to simplify these two lines into one line? I thought the following would work (nesting the eval into the if statement), but either my syntax is off or you can't do it this way.

| eval counter=if(eval(start_sum+1)=2,111,555)

Thanks!

Tags (3)
1 Solution

aweitzman
Motivator

You should be able to do math logic inline:

| eval counter=if(start_sum+1=2,111,555)

View solution in original post

aweitzman
Motivator

You should be able to do math logic inline:

| eval counter=if(start_sum+1=2,111,555)
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...