IF alternatives

[spm807]

Is there an alternative to IF(<condition>, <true>, <false>) ? I ask because I've got a couple dozen conditions to get through, and nesting all these IF statements is really awkward and ugly. I'm thinking of something like a CASE WHERE kind of command. Thanks, Splunk beginner

[PrewinThomas · Accepted solution]

@spm807 

As @gcusello  mentioned, you can use case

eg:

eval status=case(
severity="high", "Critical",
severity="medium", "Warning",
severity="low", "Info",
true(), "Unknown"
)

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[gcusello]

Hi @spm807 ,

you can use CASE, as described at https://docs.splunk.com/Documentation/Splunk/9.4.2/SearchReference/ConditionalFunctions#case.28.26lt...

Ciao.

Giuseppe