Splunk Search

How too Add exception in "case"?

Julia1231
Communicator

Hi, 

I have several model id: 12310, 12320, 12330. If the suffixes = "10", "20", "30", I define the typemachine accordingly.

type typemachine
10 car
20 moto
30 bicycle

 

| eval typemachine=case(type="10", "car", type="20", "moto ", type="30", "bicycle", 1=1, "autre")

However I want to add the exception, if id=56410 or 65210, it must be the "moto".

Can I do it, please? 

Thanks

Labels (2)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Julia1231,

the easiest approach is adding the additional conditions to your case, something like this:

| eval typemachine=case(type="10", "car", type="20", "moto", type="30", "bicycle", id=56410 OR id=65210, "moto", 1=1, "autre")

Ciao.

giuseppe

0 Karma

somesoni2
Revered Legend

I believe you want to override suffix based match, so I would put 'id' filter first so that they are checked first. Like this:

| eval typemachine=case(id="56410" OR id="65210", "moto", type="10", "car", type="20", "moto", type="30", "bicycle", true(), "autre")
0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...