Splunk Search

How to use if statements to validate two strings

moinyuso96
Path Finder

I would like TestResult to give output "1" if there are "Pass" or "Completed" in Status and "0" if otherwise. How to change this query below to check for both strings?

| eval TestResult=if(like(Status, "%Completed%"), 1, 0)

Labels (2)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @moinyuso96 

Can you try this,

| eval result=if(like(Status,"%Completed%") OR like(Status,"%Pass%"), 1 , 0 )

---

An upvote would be appreciated if this reply helps and Accept the solution!

View solution in original post

venkatasri
SplunkTrust
SplunkTrust

Hi @moinyuso96 

Can you try this,

| eval result=if(like(Status,"%Completed%") OR like(Status,"%Pass%"), 1 , 0 )

---

An upvote would be appreciated if this reply helps and Accept the solution!

Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...