How to use predicate expression in search?

[Julia1231]

Hi everybody,
My data is: A = 10, B= 20, C = 30.
the fomular that I use is: result = A/(B+C) but I have to verify, the result only displays when 3 values exist, if not (one of them or 3 of them are null), it displays as "--".

here is my command:

|eval Result= case(isnotnull(A) AND isnotnull(B) AND isnotnull(C) ,round(A/(B+ C)),1=1, "--")

For now, if one of them is null, it displays "--" but when 3 of them are null, it show the text "No result".

How can I show it llike "--" for the 2 cases: 1 of them or 3 of them are null, it always show "--"

THANKS

[ITWhisperer]

Splunk works on events in an event pipeline - if all 3 are null, it probably means there are no events in the pipeline?

Assuming this to be the case, you can use appendpipe to create an event, something like this:

| appendpipe [ stats _count | where _count = 0 | eval Result="--"]