Splunk Search

How to run a second command inside the if statment

robertlynch2020
Motivator

I have a value that could be N/A or a number. The issue is when it is a number, splunk is not picking it up as one.

So I have to run the "convert" command. But I need to check first if it is a N/A.

Below is what I have but it does not work - any ideas?

 

 

| eval T_CpuPerc = if(T_CpuPerc="N/A",T_CpuPerc,convert num(T_CpuPerc) )

 

 

 

Labels (1)
0 Karma
1 Solution

gcusello
Legend

Hi @robertlynch2020,

if an eval statement you cannot insert a command but only a function (SPL isn't a procedural language!), so if you want to format the number in T_CpuPerc you have to use a formatting function and not the convert command.

In other words, try something like this:

| eval T_CpuPerc = if(T_CpuPerc="N/A",T_CpuPerc,tonumber(T_CpuPerc))

or another function like tostring, round, etc...

Ciao.

Giuseppe

View solution in original post

robertlynch2020
Motivator

brilliant - thanks 

0 Karma

gcusello
Legend

Hi @robertlynch2020,

if an eval statement you cannot insert a command but only a function (SPL isn't a procedural language!), so if you want to format the number in T_CpuPerc you have to use a formatting function and not the convert command.

In other words, try something like this:

| eval T_CpuPerc = if(T_CpuPerc="N/A",T_CpuPerc,tonumber(T_CpuPerc))

or another function like tostring, round, etc...

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...