Splunk Search

How to use if statements to validate two strings

moinyuso96
Path Finder

I would like TestResult to give output "1" if there are "Pass" or "Completed" in Status and "0" if otherwise. How to change this query below to check for both strings?

| eval TestResult=if(like(Status, "%Completed%"), 1, 0)

Labels (2)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @moinyuso96 

Can you try this,

| eval result=if(like(Status,"%Completed%") OR like(Status,"%Pass%"), 1 , 0 )

---

An upvote would be appreciated if this reply helps and Accept the solution!

View solution in original post

venkatasri
SplunkTrust
SplunkTrust

Hi @moinyuso96 

Can you try this,

| eval result=if(like(Status,"%Completed%") OR like(Status,"%Pass%"), 1 , 0 )

---

An upvote would be appreciated if this reply helps and Accept the solution!

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...